CVE-2026-39331

ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorization by simply changing the {familyId} parameter in requests, regardless of whether they possess the required EditRecords privilege. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, and /family/{familyId}/geocode lack role-based access control, allowing users to deactivate/reactivate arbitrary families, spam verification emails, and mark families as verified and trigger geocoding. This vulnerability is fixed in 7.1.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 7.1.0, un usuario de API autenticado puede modificar el estado de cualquier registro familiar sin la autorización adecuada simplemente cambiando el parámetro {familyId} en las solicitudes, independientemente de si posee el privilegio ’EditRecords’ requerido. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status} y /family/{familyId}/geocode carecen de control de acceso basado en roles, lo que permite a los usuarios desactivar/reactivar familias arbitrarias, enviar correo no deseado de verificación y marcar familias como verificadas y activar la geocodificación. Esta vulnerabilidad está corregida en la versión 7.1.0.

Information

Published : 2026-04-07 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-39331

Mitre link : CVE-2026-39331

CVE.ORG link : CVE-2026-39331

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-863

Incorrect Authorization

{"id": "CVE-2026-39331", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39331", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T18:39:32.996807Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.1.0"}]}]}], "published": "2026-04-07T18:16:44.530", "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorization by simply changing the {familyId} parameter in requests, regardless of whether they possess the required EditRecords privilege. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, and /family/{familyId}/geocode lack role-based access control, allowing users to deactivate/reactivate arbitrary families, spam verification emails, and mark families as verified and trigger geocoding. This vulnerability is fixed in 7.1.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de la versi\u00f3n 7.1.0, un usuario de API autenticado puede modificar el estado de cualquier registro familiar sin la autorizaci\u00f3n adecuada simplemente cambiando el par\u00e1metro {familyId} en las solicitudes, independientemente de si posee el privilegio \u2019EditRecords\u2019 requerido. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status} y /family/{familyId}/geocode carecen de control de acceso basado en roles, lo que permite a los usuarios desactivar/reactivar familias arbitrarias, enviar correo no deseado de verificaci\u00f3n y marcar familias como verificadas y activar la geocodificaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 7.1.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D", "versionEndExcluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}