Executive brief
ChurchCRM, an open-source church management system, contains a security flaw that allows users to view and modify data belonging to other families. An authenticated user who should only be able to manage their own information can bypass these restrictions to access sensitive details like addresses, emails, phone numbers, and private notes of other congregation members. This could lead to unauthorized data exposure and the tampering of church records.
Technical details
ChurchCRM prior to version 7.4.0 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw, classified as CWE-639 and CWE-862. The vulnerability exists in family-scoped API endpoints, including /api/family/{familyId} and /api/timeline/family/{familyId}. While the application implements object-level authorization for individual person records, it fails to verify if a requested familyId belongs to the authenticated user's scope. An attacker with 'EditSelf' and 'Notes' permissions can supply an arbitrary familyId to read profile data, view timelines, and create unauthorized notes on records belonging to other families. This issue is resolved in version 7.4.0.
Affected products
- ChurchCRM CRM < 7.4.0
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date
- 2026-07-13: patched: Fix confirmed in version 7.4.0