CVE-2026-50767 is a stored XSS vulnerability affecting Koha Library Management System versions from 0 up to 25.11. It allows an authenticated remote attacker with administrator privileges to inject arbitrary scripts through the item type check-in message field on the administration page. The vulnerability arises from insufficient input sanitization of the checkinmsg field, enabling script injection that could lead to cross-site scripting attacks within the administrative interface.

Successful exploitation could allow an attacker with administrator access to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, unauthorized actions, or other impacts related to script execution. The confidentiality and integrity impacts are low, and availability is not affected. The attack requires authenticated administrator privileges and user interaction (UI required).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, administrators should monitor vendor communications for updates. Until a patch is available, restrict administrator access to trusted personnel and consider additional input validation or sanitization controls if feasible.