PT-2026-30955 · Churchcrm · Churchcrm

Morris-Be · CVE-2026-39331 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.1.0

Description An authenticated API user can modify any family record's state without proper authorization by changing the familyId parameter in requests, regardless of whether they possess the required EditRecords privilege. The following API endpoints lack role-based access control: '/family/{familyId}/verify', '/family/{familyId}/verify/url', '/family/{familyId}/verify/now', '/family/{familyId}/activate/{status}', and '/family/{familyId}/geocode. This allows users to deactivate or reactivate arbitrary families, send spam verification emails, and mark families as verified, triggering geocoding.

Recommendations Update to version 7.1.0 or later.

Exploit

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-39331

GHSA-VWH8-X823-WJC5

Affected Products

Churchcrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39331.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39331 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39331 · Vendor Advisory
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5 · Note
• https://twitter.com/CVEnew/status/2041603183269519383 · Twitter Post