PT-2026-33542 · Churchcrm · Churchcrm

Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40581

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.2.0

Description The family record deletion endpoint 'SelectDelete.php' performs permanent and irreversible deletion of family records and all associated data, including notes, pledges, persons, and property data. This process is triggered via a plain GET request and lacks Cross-Site Request Forgery (CSRF) token validation. A CSRF attack occurs when a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers the deletion of targeted records without user interaction.

Recommendations Update to version 7.2.0.

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2026-40581

Affected Products

Churchcrm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40581 · Security Note
• https://github.com/ChurchCRM/CRM/pull/8613 · Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj · Note
• https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674 · Note
• https://twitter.com/CVEnew/status/2045467347465425390 · Twitter Post