PT-2026-33527 · Churchcrm · Churchcrm

Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40582

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.2.0

Description The '/api/public/user/login' endpoint validates only the username and password before returning the user's API key. This process bypasses the standard authentication flow, which includes account lockout and two-factor authentication (2FA) checks. An attacker who knows a user's password can obtain API access and reach all protected API endpoints with that user's privileges, even if the account is locked or 2FA is enabled.

Recommendations Update to version 7.2.0.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

CWE-305

Related Identifiers

CVE-2026-40582

Affected Products

Churchcrm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-40582 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8cwr-x83m-mh9x · Note
• https://github.com/ChurchCRM/CRM/pull/8607 · Note
• https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850 · Note
• https://twitter.com/CVEnew/status/2045467362409824337 · Twitter Post
• https://twitter.com/0dayPublishing/status/2045282344781685092 · Twitter Post