CVE-2026-40480
HighSummary
ChurchCRM before version 7.2.0 has an object-level authorization vulnerability in the GET /api/person/{personId} endpoint. Any authenticated user with only EditSelf privileges can enumerate and read other members' records, exposing sensitive PII including names, addresses, phone numbers, and email addresses.
Risk Assessment
The risk includes unauthorized access to members' personal data, potentially violating privacy and GDPR.
Recommendation
Upgrade to version 7.2.0 which contains the fix, and implement object-level access controls.
Other vulnerabilities in ChurchCRM
See all- CVE-2026-44548High
ChurchCRM is an open-source church management system. Prior to version 7.3.2, an attacker could exploit top-level GET navigation from an external page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, allowing a logged-in user with the relevant role to silently delete records.
- CVE-2026-40482High
ChurchCRM before version 7.2.0 has an SQL injection vulnerability in FinancialService::getMemberByScanString() due to unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0.
- CVE-2026-58409Critical
In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.
- CVE-2026-44547Critical
ChurchCRM is an open-source church management system. In versions 7.2.0 to 7.2.2, the fix for CVE-2026-4058 is incomplete, allowing for exploitation of this vulnerability.
- CVE-2026-42288Critical
ChurchCRM is an open-source church management system. In versions prior to 7.3.2, the fix for CVE-2026-39337 is incomplete, allowing for pre-authentication remote code execution via unsanitized DB_PASSWORD.
- CVE-2026-40582Critical
In ChurchCRM before 7.2.0, the /api/public/user/login endpoint validates only username and password, bypassing account lockout and two-factor authentication. An attacker with knowledge of a password can obtain API access even when the account is locked or 2FA is enabled.
- CVE-2025-68112Critical
ChurchCRM before version 6.5.3 contains a SQL injection vulnerability in the Event Attendee Editor. An authenticated user can execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. Attackers can extract sensitive member data, credentials, and financial information. Version 6.5.3 includes a patch.
- CVE-2025-68110Critical
ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.
- CVE-2025-68109Critical
ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
- CVE-2025-62521Critical
ChurchCRM before version 5.21.0 contains a pre-authentication remote code execution vulnerability in the setup wizard. An unauthenticated attacker can inject arbitrary PHP code during the installation process, leading to complete server compromise. The issue arises from directly concatenating user input from the setup form into a PHP configuration template without validation.
Original NVD description (English source)
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person records without performing object-level authorization checks. Although the legacy PersonView.php page enforces canEditPerson() restrictions, the API layer omits this check. Any authenticated user with only EditSelf privileges can enumerate and read other members' records, exposing sensitive PII including names, addresses, phone numbers, and email addresses. This issue has been fixed in version 7.2.0.