CVE-2026-40485
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In ChurchCRM versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process.
Risk Assessment
An attacker can compile a list of valid usernames, facilitating subsequent brute-force or phishing attacks. The lack of rate limiting significantly increases enumeration effectiveness.
Recommendation
Update ChurchCRM to version 7.2.0 or later. Additionally, implement rate limiting and account lockout for the login endpoint.
Other vulnerabilities in ChurchCRM
See all- CVE-2026-58409Critical
In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.
- CVE-2026-44547Critical
ChurchCRM is an open-source church management system. In versions 7.2.0 to 7.2.2, the fix for CVE-2026-4058 is incomplete, allowing for exploitation of this vulnerability.
- CVE-2026-42288Critical
ChurchCRM is an open-source church management system. In versions prior to 7.3.2, the fix for CVE-2026-39337 is incomplete, allowing for pre-authentication remote code execution via unsanitized DB_PASSWORD.
- CVE-2026-40582Critical
In ChurchCRM before 7.2.0, the /api/public/user/login endpoint validates only username and password, bypassing account lockout and two-factor authentication. An attacker with knowledge of a password can obtain API access even when the account is locked or 2FA is enabled.
- CVE-2025-68112Critical
ChurchCRM before version 6.5.3 contains a SQL injection vulnerability in the Event Attendee Editor. An authenticated user can execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. Attackers can extract sensitive member data, credentials, and financial information. Version 6.5.3 includes a patch.
- CVE-2025-68110Critical
ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.
- CVE-2025-68109Critical
ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
- CVE-2025-62521Critical
ChurchCRM before version 5.21.0 contains a pre-authentication remote code execution vulnerability in the setup wizard. An unauthenticated attacker can inject arbitrary PHP code during the installation process, leading to complete server compromise. The issue arises from directly concatenating user input from the setup form into a PHP configuration template without validation.
- CVE-2026-58411High
ChurchCRM before version 7.4.0 has XSS vulnerabilities due to insufficient output encoding of user-controlled parameter names and values. An attacker can reflect malicious script into JavaScript or HTML contexts.
- CVE-2026-58410High
In ChurchCRM prior to version 7.4.0, an authorization flaw in family-scoped endpoints allowed low-privileged users to read and modify other families' records. An authenticated non-admin user with EditSelf access can supply another family's familyId and access records outside their own family scope. The backend trusts the attacker-controlled familyId and loads the corresponding family entity without verifying that the requested family belongs to the current user.
Original NVD description (English source)
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS