SB2026081398 - Multiple vulnerabilities in ChurchCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081398

SB2026081398 - Multiple vulnerabilities in ChurchCRM

Published: August 13, 2026

Security Bulletin ID SB2026081398
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 20% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Restriction of Excessive Authentication Attempts (CVE-ID: N/A)

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass two-factor authentication.

The vulnerability exists due to improper restriction of excessive authentication attempts in the TOTP verification logic in the API and browser login flows when processing repeated OTP verification requests after a correct password has been supplied. A remote attacker can submit repeated guessed TOTP or recovery codes to bypass two-factor authentication.

Exploitation requires knowledge of the victim\'s password and that the victim has two-factor authentication enabled. Recovery codes are affected through the same verification branch.


2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in an administrator\'s session.

The vulnerability exists due to improper neutralization of input during web page generation in the shared person action-menu renderer in src/skin/js/CRMJSOM.js when concatenating escaped person names into the data-person_name HTML attribute. A remote user can store a crafted person name and trigger script execution in an administrator\'s session to execute arbitrary script in an administrator\'s session.

User interaction is required because the administrator must open the dashboard action menu for the poisoned row.


3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in an administrator\'s session.

The vulnerability exists due to improper neutralization of input during web page generation in GroupView.js render callbacks for group member fields when concatenating escapeHtml output into tel:, mailto:, and data-name attributes. A remote user can store a specially crafted cell phone, email, or full name value to execute arbitrary script in an administrator\'s session.

User interaction is required when the victim opens the affected group view, and the proven exploit variant triggers on hover.


4) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in QueryView.php when processing stored-query parameters through sequential placeholder substitution. A remote user can submit specially crafted parameter values to execute arbitrary SQL commands.

Exploitation requires an authenticated account and a stored query template with two or more placeholders.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read and modify arbitrary person records.

The vulnerability exists due to improper access control in the person-properties API routes when handling requests for arbitrary personId values. A remote user can send crafted API requests to read and modify arbitrary person records.

The issue affects accounts with MenuOptions permission but without EditRecords permission, and enables reading, adding, updating, and removing custom property assignments on other users\' person records.


Remediation

Install update from vendor's website.

References