CVE-2026-39339

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc	Third Party Advisory
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 7.1.0, una vulnerabilidad crítica de omisión de autenticación en el middleware de la API de ChurchCRM (ChurchCRM/Slim/Middleware/AuthMiddleware.php) permite a atacantes no autenticados acceder a todos los puntos finales de la API protegidos al incluir ’api/public’ en cualquier parte de la URL de la solicitud, lo que lleva a la exposición completa de los datos de los miembros de la iglesia y la información del sistema. Esta vulnerabilidad está corregida en la versión 7.1.0.

Information

Published : 2026-04-07 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-39339

Mitre link : CVE-2026-39339

CVE.ORG link : CVE-2026-39339

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-39339", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39339", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T19:11:51.878805Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.1.0"}]}]}], "published": "2026-04-07T18:16:45.880", "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including \"api/public\" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de la versi\u00f3n 7.1.0, una vulnerabilidad cr\u00edtica de omisi\u00f3n de autenticaci\u00f3n en el middleware de la API de ChurchCRM (ChurchCRM/Slim/Middleware/AuthMiddleware.php) permite a atacantes no autenticados acceder a todos los puntos finales de la API protegidos al incluir \u2019api/public\u2019 en cualquier parte de la URL de la solicitud, lo que lleva a la exposici\u00f3n completa de los datos de los miembros de la iglesia y la informaci\u00f3n del sistema. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 7.1.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D", "versionEndExcluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}