Authorization bypass through user-controlled key in ChurchCRM - #VU156124
Published: October 19, 2026
Vulnerability identifier: #VU156124
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read and modify sensitive pastoral-care notes associated with any person in ChurchCRM.
The vulnerability exists due to missing object-level authorization in WhyCameEditor.php when handling requests containing a user-supplied PersonID. A remote user can supply another person's PersonID in GET or POST requests to read or overwrite their reasons for joining and attending the church, suggestions, and information about how they heard about the church.
Affected software
ChurchCRM
Remediation
Install security update from vendor's website.
ChurchCRM - update to 7.4.2