CVE-2026-40581

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674
https://github.com/ChurchCRM/CRM/pull/8613
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. En versiones anteriores a la 7.2.0, el endpoint de eliminación de registros familiares (SelectDelete.php) realiza la eliminación permanente e irreversible de registros familiares y todos los datos asociados a través de una solicitud GET simple sin validación de token CSRF. Un atacante puede crear una página maliciosa que, al ser visitada por un administrador autenticado, activa silenciosamente la eliminación de registros familiares específicos, incluyendo notas asociadas, promesas de donación, personas y datos de propiedad, sin ninguna interacción del usuario. Este problema ha sido solucionado en la versión 7.2.0.

Information

Published : 2026-04-18 00:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40581

Mitre link : CVE-2026-40581

CVE.ORG link : CVE-2026-40581

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-862

Missing Authorization

{"id": "CVE-2026-40581", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40581", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:09:32.310175Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.2.0"}]}]}], "published": "2026-04-18T00:16:39.683", "references": [{"url": "https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674", "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/pull/8613", "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. En versiones anteriores a la 7.2.0, el endpoint de eliminaci\u00f3n de registros familiares (SelectDelete.php) realiza la eliminaci\u00f3n permanente e irreversible de registros familiares y todos los datos asociados a trav\u00e9s de una solicitud GET simple sin validaci\u00f3n de token CSRF. Un atacante puede crear una p\u00e1gina maliciosa que, al ser visitada por un administrador autenticado, activa silenciosamente la eliminaci\u00f3n de registros familiares espec\u00edficos, incluyendo notas asociadas, promesas de donaci\u00f3n, personas y datos de propiedad, sin ninguna interacci\u00f3n del usuario. Este problema ha sido solucionado en la versi\u00f3n 7.2.0."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-advisories@github.com"}