CVE-2026-40485

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850
https://github.com/ChurchCRM/CRM/pull/8607
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. En versiones anteriores a la 7.2.0, el endpoint de inicio de sesión de la API pública (/api/public/user/login) devuelve códigos de respuesta HTTP distinguibles según si un nombre de usuario existe: 404 para usuarios inexistentes y 401 para usuarios válidos con contraseñas incorrectas. Un atacante no autenticado puede explotar esta diferencia para enumerar nombres de usuario válidos, sin limitación de velocidad (rate limiting) ni bloqueo de cuenta (account lockout) que impidan el proceso. Este problema ha sido solucionado en la versión 7.2.0.

Information

Published : 2026-04-18 00:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40485

Mitre link : CVE-2026-40485

CVE.ORG link : CVE-2026-40485

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-40485", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40485", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:28:51.363754Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.2.0"}]}]}], "published": "2026-04-18T00:16:39.540", "references": [{"url": "https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850", "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/pull/8607", "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-204"}, {"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. En versiones anteriores a la 7.2.0, el endpoint de inicio de sesi\u00f3n de la API p\u00fablica (/api/public/user/login) devuelve c\u00f3digos de respuesta HTTP distinguibles seg\u00fan si un nombre de usuario existe: 404 para usuarios inexistentes y 401 para usuarios v\u00e1lidos con contrase\u00f1as incorrectas. Un atacante no autenticado puede explotar esta diferencia para enumerar nombres de usuario v\u00e1lidos, sin limitaci\u00f3n de velocidad (rate limiting) ni bloqueo de cuenta (account lockout) que impidan el proceso. Este problema ha sido solucionado en la versi\u00f3n 7.2.0."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-advisories@github.com"}