CVE-2026-58408
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In ChurchCRM prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse 'has any admin permission' gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.
Risk Assessment
The organization risks exposure of sensitive Personally Identifiable Information (PII) of all members, potentially leading to data protection regulation violations (e.g., GDPR) and loss of trust. An attacker with minimal privileges can easily download the full personal data database.
Recommendation
Immediately upgrade ChurchCRM to version 7.4.0 or later. If an upgrade is not possible, temporarily restrict access to the POST /CSVCreateFile.php endpoint for all unauthorized users at the firewall or web server level.
Other vulnerabilities in ChurchCRM
See all- CVE-2026-44548High
ChurchCRM is an open-source church management system. Prior to version 7.3.2, an attacker could exploit top-level GET navigation from an external page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, allowing a logged-in user with the relevant role to silently delete records.
- CVE-2026-40482High
ChurchCRM before version 7.2.0 has an SQL injection vulnerability in FinancialService::getMemberByScanString() due to unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0.
- CVE-2026-40480High
ChurchCRM before version 7.2.0 has an object-level authorization vulnerability in the GET /api/person/{personId} endpoint. Any authenticated user with only EditSelf privileges can enumerate and read other members' records, exposing sensitive PII including names, addresses, phone numbers, and email addresses.
- CVE-2026-58409Critical
In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.
- CVE-2026-44547Critical
ChurchCRM is an open-source church management system. In versions 7.2.0 to 7.2.2, the fix for CVE-2026-4058 is incomplete, allowing for exploitation of this vulnerability.
- CVE-2026-42288Critical
ChurchCRM is an open-source church management system. In versions prior to 7.3.2, the fix for CVE-2026-39337 is incomplete, allowing for pre-authentication remote code execution via unsanitized DB_PASSWORD.
- CVE-2026-40582Critical
In ChurchCRM before 7.2.0, the /api/public/user/login endpoint validates only username and password, bypassing account lockout and two-factor authentication. An attacker with knowledge of a password can obtain API access even when the account is locked or 2FA is enabled.
- CVE-2025-68112Critical
ChurchCRM before version 6.5.3 contains a SQL injection vulnerability in the Event Attendee Editor. An authenticated user can execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. Attackers can extract sensitive member data, credentials, and financial information. Version 6.5.3 includes a patch.
- CVE-2025-68110Critical
ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.
- CVE-2025-68109Critical
ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
Original NVD description (English source)
ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.