PT-2026-33533 · Churchcrm · Crm

Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40485

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-204

CWE-307

Related Identifiers

CVE-2026-40485

Affected Products

Crm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40485 · Security Note
• https://github.com/ChurchCRM/CRM/pull/8607 · Note
• https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850 · Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx · Note