CVE-2026-50766 describes a stored XSS vulnerability in the Koha Library Management System affecting versions from 0 up to but not including 25.12. An attacker with authenticated access and edit_items permission can inject malicious scripts through the item public notes field (items.itemnotes) on the OPAC item detail page. This can lead to script execution in the context of users viewing the affected page, potentially impacting confidentiality and integrity. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). No official fix or patch has been documented as of the published date.

Successful exploitation allows an authenticated user with edit_items permission to inject arbitrary scripts that execute in the browsers of users viewing the affected item detail pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or modification of displayed content. There is no direct availability impact. The vulnerability requires authentication and user interaction (UI:R).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict edit_items permissions to trusted users only and consider sanitizing or validating input in the item public notes field as a temporary measure.