This vulnerability arises from improper neutralization of special elements in an SQL command (CWE-89) within Koha Community versions 25.05.0, 25.11.0, and 26.05.0. Authenticated staff users with the items_batchmod permission can supply a crafted agefield value in the automatic item modifications by age tool. This value is stored verbatim and later interpolated without escaping in the C4::Items::ToggleNewStatus function during a scheduled cron job execution, enabling stored SQL injection. The flaw allows attackers to read sensitive database contents, including patron PII and staff password hashes, and influence batch job behavior.

Successful exploitation allows an authenticated staff user to execute arbitrary SQL commands in the Koha database context. This can lead to disclosure of sensitive data such as patron personally identifiable information and staff password hashes. Additionally, attackers can manipulate which items are modified by the batch job, potentially impacting data integrity. The vulnerability does not appear to allow denial of service or privilege escalation beyond the authenticated staff role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict the items_batchmod permission to trusted staff only and monitor usage of the automatic item modifications by age tool to limit exposure.