PT-2026-33542 · Churchcrm · Churchcrm

CVE-2026-40581 · Published 2026-04-17 · Updated 2026-04-18

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.2.0

Description The family record deletion endpoint 'SelectDelete.php' performs permanent and irreversible deletion of family records and all associated data, including notes, pledges, persons, and property data. This process is triggered via a plain GET request and lacks Cross-Site Request Forgery (CSRF) token validation. A CSRF attack occurs when a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers the deletion of targeted records without user interaction.

Recommendations Update to version 7.2.0.

Exploit

Fix

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2026-40581

GHSA-6QXV-XW9J-77PJ

Affected Products

Churchcrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40581.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40581 · Security Note
• https://github.com/ChurchCRM/CRM/pull/8613 · Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj · Note
• https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674 · Note
• https://twitter.com/CVEnew/status/2045467347465425390 · Twitter Post