SB2026101930 - Authorization bypass through user-controlled key in ChurchCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101930

SB2026101930 - Authorization bypass through user-controlled key in ChurchCRM

Published: October 19, 2026

Security Bulletin ID SB2026101930
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read and modify sensitive pastoral-care notes associated with any person in ChurchCRM.

The vulnerability exists due to missing object-level authorization in WhyCameEditor.php when handling requests containing a user-supplied PersonID. A remote user can supply another person's PersonID in GET or POST requests to read or overwrite their reasons for joining and attending the church, suggestions, and information about how they heard about the church.


Remediation

Install update from vendor's website.

References