CVE-2026-50765 is a stored XSS vulnerability affecting Koha Library Management System versions from 0 up to but not including 25.12. An authenticated remote attacker with administrator privileges can exploit this issue by injecting malicious scripts into the restriction type label (display_text field) on the patron restriction type administration page. This could lead to script execution in the context of other administrators or users viewing this page.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary scripts in the context of the application, potentially leading to session hijacking, unauthorized actions, or data exposure limited to the scope of the affected administrative interface. The impact is limited to confidentiality and integrity with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and consider additional input validation or output encoding controls on the affected field if possible.