CVE-2026-72607: Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => itemsbatchmod permission to execute arbitrary SQL via the agefield value in the automatic item modifications by age tool. The agefield value is stored verbatim and later interpolated without escaping into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. An attacker can read the entire Koha database including patron PII and staff password hashes, and influence which items the batch job modifies.