# CVE-2026-39341: ChurchCRM SQL injection in ConfirmReportEmail.php

Source: https://junglewise.ai/threats/cve-2026-39341-churchcrm-sql-injection-in-confirmreportemail-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39341 · Severity: high · CVSS 8.1 · Published 2026-04-07

ChurchCRM, an open-source church management system, is vulnerable to a security flaw that allows attackers to interfere with its database. By sending specially crafted requests to a specific report generation page, an authorized user can trick the system into executing unintended database commands. This could lead to the theft of sensitive member information or unauthorized changes to church records.

Technologies: [ChurchCRM](https://junglewise.ai/threats/technologies/churchcrm). Vendors: [ChurchCRM](https://junglewise.ai/threats/vendors/churchcrm).

## Quick answers

**Is CVE-2026-39341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39341 being exploited in the wild.

**How severe is CVE-2026-39341?** High severity, with a CVSS score of 8.1, published 7 April 2026.

**Which products and versions are affected?** ChurchCRM CRM < 7.1.0.

**Is there a fix for CVE-2026-39341?** A patch was published on 2026-04-07: Fix released in version 7.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39341 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39341?** Check whether you run ChurchCRM. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based SQL injection vulnerability exists in ChurchCRM versions prior to 7.1.0. The flaw is located in the `src/Reports/ConfirmReportEmail.php` endpoint, specifically within the `familyId` GET parameter. Although the application attempts to filter the input using `InputUtils::legacyFilterInput`, the original unsanitized `$_GET['familyId']` value is used to construct the SQL query instead of the sanitized result. An authenticated attacker can exploit this by injecting SQL syntax (e.g., using `SLEEP()` commands) to extract data or manipulate the database. The issue is resolved in version 7.1.0.

## Affected products

- ChurchCRM CRM < 7.1.0

## Timeline

- 2026-04-05: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-39341 published
- 2026-04-07: patched: Fix released in version 7.1.0

## References

- [https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3h69-vjff-jj5c](https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3h69-vjff-jj5c)

## Related threats

- [ChurchCRM CRM authorization bypass in family-scoped endpoints](https://junglewise.ai/threats/cve-2026-58410-churchcrm-crm-authorization-bypass-in-family-scoped-endpoints)
- [ChurchCRM unrestricted file upload in plugin installer](https://junglewise.ai/threats/cve-2026-58409-churchcrm-unrestricted-file-upload-in-plugin-installer)
- [ChurchCRM broken access control in CSVCreateFile.php export](https://junglewise.ai/threats/cve-2026-58408-churchcrm-broken-access-control-in-csvcreatefile-php-export)
- [ChurchCRM CSRF in legacy delete endpoints](https://junglewise.ai/threats/cve-2026-44548-churchcrm-csrf-in-legacy-delete-endpoints)
- [ChurchCRM 2FA and account lockout bypass in public API login](https://junglewise.ai/threats/cve-2026-44547-churchcrm-2fa-and-account-lockout-bypass-in-public-api-login)