Junglewise Threat Intelligence

CVE-2026-58410: ChurchCRM CRM authorization bypass in family-scoped endpoints

CVE-2026-58410 · Severity: high · CVSS 7.1 · Published 2026-07-13

Technologies: ChurchCRM. Vendors: ChurchCRM.

Executive brief

ChurchCRM, an open-source church management system, contains a security flaw that allows users to view and modify data belonging to other families. An authenticated user who should only be able to manage their own information can bypass these restrictions to access sensitive details like addresses, emails, phone numbers, and private notes of other congregation members. This could lead to unauthorized data exposure and the tampering of church records.

Technical details

ChurchCRM prior to version 7.4.0 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw, classified as CWE-639 and CWE-862. The vulnerability exists in family-scoped API endpoints, including /api/family/{familyId} and /api/timeline/family/{familyId}. While the application implements object-level authorization for individual person records, it fails to verify if a requested familyId belongs to the authenticated user's scope. An attacker with 'EditSelf' and 'Notes' permissions can supply an arbitrary familyId to read profile data, view timelines, and create unauthorized notes on records belonging to other families. This issue is resolved in version 7.4.0.

Affected products

  • ChurchCRM CRM < 7.4.0

Timeline

  • 2026-06-18: advisory: GitHub Security Advisory published
  • 2026-07-13: disclosed: NVD publication date
  • 2026-07-13: patched: Fix confirmed in version 7.4.0

References

Related threats