CVE-2026-39328

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X profile fields. Due to a 50-character field limit, the payload is distributed across all three fields and chains their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server. This vulnerability is fixed in 7.1.0.

CVSS v3 8.9 HIGH

8.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcp5-pwvj-v7xm	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 7.1.0, existe una vulnerabilidad de cross-site scripting almacenado en la funcionalidad de edición de perfiles de persona de ChurchCRM. Los usuarios no administrativos que tienen el permiso EditSelf pueden inyectar JavaScript malicioso en sus campos de perfil de Facebook, LinkedIn y X. Debido a un límite de campo de 50 caracteres, la carga útil se distribuye entre los tres campos y encadena sus manejadores de eventos onfocus para ejecutarse en secuencia. Cuando cualquier usuario, incluidos los administradores, ve el perfil del atacante, sus cookies de sesión son exfiltradas a un servidor remoto. Esta vulnerabilidad se corrige en la versión 7.1.0.

Information

Published : 2026-04-07 18:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-39328

Mitre link : CVE-2026-39328

CVE.ORG link : CVE-2026-39328

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-39328", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39328", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T15:49:46.149377Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.1.0"}]}]}], "published": "2026-04-07T18:16:44.043", "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcp5-pwvj-v7xm", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X profile fields. Due to a 50-character field limit, the payload is distributed across all three fields and chains their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server. This vulnerability is fixed in 7.1.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de la versi\u00f3n 7.1.0, existe una vulnerabilidad de cross-site scripting almacenado en la funcionalidad de edici\u00f3n de perfiles de persona de ChurchCRM. Los usuarios no administrativos que tienen el permiso EditSelf pueden inyectar JavaScript malicioso en sus campos de perfil de Facebook, LinkedIn y X. Debido a un l\u00edmite de campo de 50 caracteres, la carga \u00fatil se distribuye entre los tres campos y encadena sus manejadores de eventos onfocus para ejecutarse en secuencia. Cuando cualquier usuario, incluidos los administradores, ve el perfil del atacante, sus cookies de sesi\u00f3n son exfiltradas a un servidor remoto. Esta vulnerabilidad se corrige en la versi\u00f3n 7.1.0."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D", "versionEndExcluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}