Executive brief
ChurchCRM, an open-source church management system, is affected by a security flaw where the public login interface for its API fails to enforce two-factor authentication (2FA) and account lockout protections. This occurred because a previous security fix was accidentally removed during the software development process. An attacker with a user's password can bypass 2FA requirements to gain full access to sensitive financial and member data, even if the account was supposed to be locked due to suspicious activity.
Technical details
A regression in ChurchCRM versions 7.2.0 through 7.2.2 caused the silent removal of security hardening logic in 'src/api/routes/public/public-user.php'. Specifically, the 'userLogin' function lacks calls to 'isLocked()', 'setFailedLogins()', and 'is2FactorAuthEnabled()'. While the web-based browser login correctly enforces these controls, the public API endpoint returns a valid 'apiKey' upon password validation alone. An attacker with valid user credentials can bypass 2FA and account lockouts to obtain an API key, which can then be used to access protected routes (such as financial deposits) via 'AuthMiddleware.php'. This is an incomplete fix for a previous vulnerability (CVE-2026-40582). The issue is resolved in version 7.3.1.
Affected products
- ChurchCRM ChurchCRM 7.2.0 - 7.2.2
Timeline
- 2026-04-29: patched: Fix merged into master for version 7.3.1
- 2026-05-01: advisory: GitHub Security Advisory GHSA-cwp8-rm8g-q5c9 published
- 2026-05-12: disclosed: CVE-2026-44547 published to NVD