CVE-2026-42289: ChurchCRM CSRF in UserEditor.php leads to privilege escalation

CVE-2026-42289 · Severity: high · CVSS 8.8 · Published 2026-05-12

ChurchCRM, an open-source church management system, contains a security flaw that allows an attacker to take over administrative accounts. By tricking a logged-in administrator into visiting a malicious website, an attacker can silently create new administrator accounts or elevate their own permissions. This could lead to a total compromise of the organization's database, including sensitive member information and financial records.

Technologies: ChurchCRM. Vendors: ChurchCRM.

Quick answers

Is CVE-2026-42289 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42289 being exploited in the wild.
How severe is CVE-2026-42289?
High severity, with a CVSS score of 8.8, published 12 May 2026.
Which products and versions are affected?
ChurchCRM < 7.3.2.
Is there a fix for CVE-2026-42289?
A patch was published on 2026-05-12: Vulnerability fixed in version 7.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42289 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42289?
Check whether you run ChurchCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in ChurchCRM's UserEditor.php component due to a lack of anti-CSRF token validation. The application processes critical user management actions, such as account creation and permission updates, directly from $_POST parameters. An unauthenticated attacker can exploit this by hosting a malicious HTML page that auto-submits a POST request to the vulnerable endpoint. If an authenticated administrator visits this page, the request executes in their session context, allowing the attacker to grant administrative privileges to any user ID or create new accounts. The vulnerability is resolved in version 7.3.2 by implementing CSRF token verification.

Affected products

  • ChurchCRM ChurchCRM < 7.3.2

Timeline

  • 2026-04-29: advisory: Initial GitHub security advisory published
  • 2026-05-12: disclosed: CVE-2026-42289 published to NVD
  • 2026-05-12: patched: Vulnerability fixed in version 7.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.