PT-2026-20912 · Churchcrm · Churchcrm

Shingleskat · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-26059

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.8.2

Description ChurchCRM is an open-source church management system. An authenticated user with permission to edit groups could store a JavaScript payload that would execute when the group was viewed in the Group View. The Group View is the affected component. Version 6.8.2 resolves this issue.

Recommendations Update to version 6.8.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26059

GHSA-3WP4-VPR7-47Q6

Affected Products

Churchcrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26059.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3wp4-vpr7-47q6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26059 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26059 · Vendor Advisory
• https://twitter.com/CVEnew/status/2025809101268320383 · Twitter Post