This vulnerability is an SQL Injection (CWE-89) in the reports/catalogue_out.pl component of Koha Community Koha. It affects versions through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00. An authenticated staff user with the Reports module flag can exploit the Filter URL parameter when the Criteria parameter matches /branchcode/ to read arbitrary data from the Koha database. The CVSS 4.0 score is 5.6 (medium severity), reflecting network attack vector, low attack complexity, partial privileges, no user interaction, and high impact on confidentiality.

An authenticated staff user with the Reports module flag can exploit this vulnerability to perform SQL Injection attacks that allow reading arbitrary data from the Koha application database. This could lead to unauthorized disclosure of sensitive information stored in the database. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Reports module to trusted staff only and monitor for suspicious activity related to the Filter and Criteria URL parameters. Avoid exposing the affected endpoints to untrusted users.