PT-2025-41335 · Churchcrm · Churchcrm

Uartu0 · Published 2025-10-09 · Updated 2025-10-09 · CVE-2025-11529

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.18.0

Description A security flaw exists in ChurchCRM impacting the AuthMiddleware function within the src/ChurchCRM/Slim/Middleware/AuthMiddleware.php file of the API Endpoint component. This allows for missing authentication and can be exploited remotely. The exploit has been publicly released.

Recommendations Apply the patch identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2025-11529

Affected Products

Churchcrm

References · 13

• 🔥 https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md · Exploit
• https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-11529 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11529 · Vendor Advisory
• https://github.com/ChurchCRM/CRM/pull/7376 · Note
• https://vuldb.com/?ctiid.327667 · Note
• https://twitter.com/VulmonFeeds/status/1976138830450200837 · Twitter Post
• https://vuldb.com/?id.327667 · Note
• https://t.me/cveNotify/137993 · Telegram Post
• https://vuldb.com/?submit.669916 · Note
• https://t.me/cveNotify/137927 · Telegram Post
• https://twitter.com/CVEnew/status/1976132532295913548 · Twitter Post
• https://t.me/CVEtracker/34485 · Telegram Post