PT-2026-33533 · Churchcrm · Churchcrm

Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40485

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.2.0

Description The public API login endpoint '/api/public/user/login' returns different HTTP response codes depending on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can use this behavior to enumerate valid usernames, as there is no rate limiting or account lockout mechanism to prevent the process.

Recommendations Update to version 7.2.0.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-204

CWE-307

Related Identifiers

CVE-2026-40485

Affected Products

Churchcrm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40485 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx · Note
• https://github.com/ChurchCRM/CRM/pull/8607 · Note
• https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850 · Note
• https://twitter.com/CVEnew/status/2045467354247602275 · Twitter Post