SB2026072016 - Multiple vulnerabilities in ChurchCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072016

SB2026072016 - Multiple vulnerabilities in ChurchCRM

Published: July 20, 2026

Security Bulletin ID SB2026072016
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Exposure of Sensitive Information Through Data Queries (CVE-ID: CVE-2026-58407)

CWE-ID: CWE-202 - Exposure of Sensitive Information Through Data Queries

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information through data queries in api/routes/people/people-person.php when exporting person records to JSON. A remote user can request their own person record to disclose sensitive information.

The response can include the pre-loaded User ORM object with a bcrypt hash, API key, and TOTP secret.


2) Cross-site scripting (CVE-ID: CVE-2026-58411)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim's browser.

The vulnerability exists due to cross-site scripting in request parameter handling in /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info when rendering attacker-controlled parameter names and values into JavaScript string contexts and HTML attribute contexts. A remote attacker can send a specially crafted request and trick a victim into visiting the malicious URL to execute arbitrary JavaScript in the victim's browser.

User interaction is required to visit a crafted URL.


3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-58410)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify records.

The vulnerability exists due to authorization bypass through a user-controlled key in the family API endpoints when handling requests with an attacker-controlled familyId. A remote user can supply another family's familyId to read profile data, notes, and timeline entries, and create notes on another family's record to disclose sensitive information and modify records.

Note read and write access requires the Notes permission.


4) Arbitrary file upload (CVE-ID: CVE-2026-58409)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to unrestricted upload of files with dangerous types in ChurchCRM/Plugin/PluginInstaller.php and plugins/routes/api/management.php when installing a plugin ZIP archive from a URL. A remote privileged user can upload a crafted plugin archive containing a PHP file to execute arbitrary code.

The uploaded archive is extracted under the web root, and the PHP file can be executed via HTTP without enabling the plugin through the application interface.


5) Incorrect authorization (CVE-ID: CVE-2026-58408)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in the CSVCreateFile.php endpoint when handling crafted export requests. A remote user can submit a specially crafted POST request directly to the export endpoint to disclose sensitive information.

The issue can expose the full personally identifiable information of every Person and Family record, including custom fields, by bypassing the intended export user interface.


Remediation

Install update from vendor's website.

References