# CVE-2026-58408: ChurchCRM broken access control in CSVCreateFile.php export

Source: https://junglewise.ai/threats/cve-2026-58408-churchcrm-broken-access-control-in-csvcreatefile-php-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-58408 · Severity: medium · CVSS 6.5 · Published 2026-07-13

ChurchCRM, an open-source church management system, contains a security flaw that allows users with minimal access rights to download the entire member directory. By bypassing the intended administrative interface, a low-privileged user can export a file containing sensitive personal information for every member and family in the database, including names, addresses, phone numbers, and dates of birth. This unauthorized access could lead to significant privacy breaches, identity theft risks for members, and potential regulatory compliance issues for the organization.

Technologies: [ChurchCRM](https://junglewise.ai/threats/technologies/churchcrm). Vendors: [ChurchCRM](https://junglewise.ai/threats/vendors/churchcrm).

## Quick answers

**Is CVE-2026-58408 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58408 being exploited in the wild.

**How severe is CVE-2026-58408?** Medium severity, with a CVSS score of 6.5, published 13 July 2026.

**Which products and versions are affected?** ChurchCRM < 7.4.0.

**Is there a fix for CVE-2026-58408?** A patch was published on 2026-07-13: Fix confirmed in version 7.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58408 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58408?** Check whether you run ChurchCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in ChurchCRM's CSV export functionality. The 'CSVCreateFile.php' endpoint relies on a legacy authorization gate in 'PageInit.php' that incorrectly grants access to any user possessing any single administrative-related permission (such as adding records or managing groups), rather than requiring full administrator rights or a specific export permission. An authenticated attacker with low-level privileges can bypass the intended UI restrictions by sending a direct POST request to the export endpoint. This allows for the bulk exfiltration of Personally Identifiable Information (PII) for all records in the database. The issue is addressed in version 7.4.0 by implementing stricter authorization checks.

## Affected products

- ChurchCRM ChurchCRM < 7.4.0

## Timeline

- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date
- 2026-07-13: patched: Fix confirmed in version 7.4.0

## References

- [https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63](https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63)

## Related threats

- [ChurchCRM CRM authorization bypass in family-scoped endpoints](https://junglewise.ai/threats/cve-2026-58410-churchcrm-crm-authorization-bypass-in-family-scoped-endpoints)
- [ChurchCRM unrestricted file upload in plugin installer](https://junglewise.ai/threats/cve-2026-58409-churchcrm-unrestricted-file-upload-in-plugin-installer)
- [ChurchCRM CSRF in legacy delete endpoints](https://junglewise.ai/threats/cve-2026-44548-churchcrm-csrf-in-legacy-delete-endpoints)
- [ChurchCRM 2FA and account lockout bypass in public API login](https://junglewise.ai/threats/cve-2026-44547-churchcrm-2fa-and-account-lockout-bypass-in-public-api-login)
- [ChurchCRM CSRF in UserEditor.php leads to privilege escalation](https://junglewise.ai/threats/cve-2026-42289-churchcrm-csrf-in-usereditor-php-leads-to-privilege-escalation)