PT-2025-51870 · Churchcrm · Churchcrm

Vesp3Rtine · Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-66397

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM, an open-source church management system, has an issue with access control in the Kiosk Manager feature. Specifically, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions are affected. Any authenticated user can perform actions such as allowing and accepting kiosk registrations, reloading, and identifying kiosks.

Recommendations Update to version 6.5.3 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-66397

GHSA-32VR-CH3P-WMR5

Affected Products

Churchcrm

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66397.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-32vr-ch3p-wmr5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66397 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66397 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2001397846764130737 · Twitter Post
• https://twitter.com/CVEnew/status/2002835978738688362 · Twitter Post