SB2026072018 - Multiple vulnerabilities in ChurchCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072018

SB2026072018 - Multiple vulnerabilities in ChurchCRM

Published: July 20, 2026 Updated: July 28, 2026

Security Bulletin ID SB2026072018
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 10% Low 90%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: N/A)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's browser session.

The vulnerability exists due to improper neutralization of script-related html tags in a web page in the family record view phone custom-field link rendering in people/views/family-view.php when rendering a phone-type custom field value into an unescaped tel: href attribute. A remote user can store a specially crafted phone custom-field value to execute arbitrary JavaScript in a victim's browser session.

User interaction is required when a victim views the affected family record, and exploitation requires family-edit rights and a phone-type family custom field.


2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access and modify records outside the authorized event roster.

The vulnerability exists due to improper access control in the kiosk device check-in, check-out, and notification endpoints when processing a client-supplied PersonId. A remote user can submit a crafted request with an arbitrary PersonId to access and modify records outside the authorized event roster.

The issue affects admin-accepted kiosk devices assigned to an event, and can impact attendance records, timeline notes, and family notifications for people not on the kiosk's active class roster.


3) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: N/A)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's authenticated session.

The vulnerability exists due to improper neutralization of script-related html tags in a web page in DonatedItemEditor.php when rendering a stored donated-item name into an HTML value attribute in edit mode. A remote user can store a specially crafted donated-item name to execute arbitrary JavaScript in a victim's authenticated session.

User interaction is required when a finance user re-opens the item's editor.


4) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: N/A)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the victim's authenticated session.

The vulnerability exists due to cross-site scripting in FamilyEditor.php member name fields when rendering stored family member names into HTML value attributes. A remote user can store a crafted name value to execute arbitrary JavaScript in the victim's authenticated session.

No user interaction is required once a victim opens the affected family editor page.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim's authenticated session.

The vulnerability exists due to cross-site scripting in MemberRoleChange.php when handling the Return query parameter. A remote attacker can send a specially crafted link to execute arbitrary JavaScript in the victim's authenticated session.

User interaction is required, and the victim must have the Manage Groups & Roles permission.


6) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in the main dashboard Location column renderer in MainDashboard.js when rendering family address data returned by the families API. A remote user can inject a crafted address value to execute arbitrary script in a victim's browser.

The payload is stored and executes when a user lands on the /v2/dashboard page after login. Anonymous exploitation is possible if self-registration is enabled.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to cross-site scripting in person/family record views when rendering a person's name into an HTML attribute. A remote user can supply a crafted person name containing a JavaScript event handler to execute arbitrary script code in a victim's browser.

An anonymous user can exploit this issue if self-registration is enabled, and user interaction is required when a staff member or administrator views the affected person or family record.


8) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in GroupView.js and GroupRoles.js when rendering unescaped group-role names returned by the roles API into the DOM as HTML. A remote user can create or leverage a crafted role name to execute arbitrary script in a victim's browser.

Exploitation requires authenticated access and a role or option name that bypasses the normal sanitization paths, such as pre-existing unsanitized data, migrated records, or data introduced through alternate write paths. User interaction is required to open the affected group's view page.


9) Incomplete cleanup (CVE-ID: N/A)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incomplete cleanup in the database reset endpoint when clearing uploaded person and family photos during a database reset. A remote privileged user can trigger a database reset to disclose sensitive information.

On case-sensitive filesystems, uploaded photos stored under `/Images/Person` and `/Images/Family` remain on disk because the cleanup logic targets lowercase directories instead.


10) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the web-accessible /Images/Person/ and /Images/Family/ directories when requesting predictable static file paths for uploaded photos. A remote attacker can request crafted direct file paths to disclose sensitive information.

Uploaded person and family photos are intended to be retrieved through authenticated API endpoints, but numeric entity IDs are used as filenames for directly served PNG files.


Remediation

Install update from vendor's website.

References