PT-2026-33527 · Churchcrm · Churchcrm

CVE-2026-40582 · Published 2026-04-17 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.2.0

Description The '/api/public/user/login' endpoint validates only the username and password before returning the user's API key. This process bypasses the standard authentication flow, which includes account lockout and two-factor authentication (2FA) checks. An attacker who knows a user's password can obtain API access and reach all protected API endpoints with that user's privileges, even if the account is locked or 2FA is enabled.

Recommendations Update to version 7.2.0.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-305

CWE-288

Related Identifiers

CVE-2026-40582

GHSA-8CWR-X83M-MH9X

Affected Products

Churchcrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40582.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40582 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8cwr-x83m-mh9x · Note
• https://github.com/ChurchCRM/CRM/pull/8607 · Note
• https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850 · Note
• https://t.me/CVEtracker/53584 · Telegram Post
• https://twitter.com/0dayPublishing/status/2045282344781685092 · Twitter Post
• https://twitter.com/CVEnew/status/2045467362409824337 · Twitter Post