PT-2025-41335 · Churchcrm · Churchcrm

Uartu0 · CVE-2025-11529 · Published 2025-10-09 · Updated 2025-10-09

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.18.0

Description A security flaw exists in ChurchCRM impacting the AuthMiddleware function within the src/ChurchCRM/Slim/Middleware/AuthMiddleware.php file of the API Endpoint component. This allows for missing authentication and can be exploited remotely. The exploit has been publicly released.

Recommendations Apply the patch identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4.

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2025-11529

Affected Products

Churchcrm

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11529.json · Exploit
• 🔥 https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md · Exploit
• https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 · Patch
• https://osv.dev/vulnerability/CVE-2025-11529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11529 · Security Note
• https://github.com/ChurchCRM/CRM/pull/7376 · Note
• https://vuldb.com/?id.327667 · Note
• https://t.me/CVEtracker/34485 · Telegram Post
• https://t.me/cveNotify/137927 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1976138830450200837 · Twitter Post
• https://t.me/cveNotify/137993 · Telegram Post
• https://vuldb.com/?ctiid.327667 · Note
• https://vuldb.com/?submit.669916 · Note
• https://twitter.com/CVEnew/status/1976132532295913548 · Twitter Post