Executive brief
ChurchCRM, an open-source church management system, contains a security flaw that allows an attacker to take over administrative accounts. By tricking a logged-in administrator into visiting a malicious website, an attacker can silently create new administrator accounts or elevate their own permissions. This could lead to a total compromise of the organization's database, including sensitive member information and financial records.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in ChurchCRM's UserEditor.php component due to a lack of anti-CSRF token validation. The application processes critical user management actions, such as account creation and permission updates, directly from $_POST parameters. An unauthenticated attacker can exploit this by hosting a malicious HTML page that auto-submits a POST request to the vulnerable endpoint. If an authenticated administrator visits this page, the request executes in their session context, allowing the attacker to grant administrative privileges to any user ID or create new accounts. The vulnerability is resolved in version 7.3.2 by implementing CSRF token verification.
Affected products
- ChurchCRM ChurchCRM < 7.3.2
Timeline
- 2026-04-29: advisory: Initial GitHub security advisory published
- 2026-05-12: disclosed: CVE-2026-42289 published to NVD
- 2026-05-12: patched: Vulnerability fixed in version 7.3.2