PT-2026-30962 · Churchcrm · Crm

Uartu0 · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39339

NVD

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-39339

Affected Products

Crm

References · 2

• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39339 · Security Note