PT-2026-40464 · Churchcrm · Churchcrm

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-44548

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.3.2

Description Top-level cross-site GET navigation from an attacker-controlled page to the endpoints "FundRaiserDelete.php", "PropertyTypeDelete.php", or "NoteDelete.php" allows a logged-in user with the appropriate role to silently delete records. This includes the deletion of cascaded property and record-to-property assignments.

Recommendations Update to version 7.3.2.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-650

CWE-352

Related Identifiers

CVE-2026-44548

Affected Products

Churchcrm

References · 5

• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-jx5r-p82p-2p8m · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44548 · Security Note
• https://twitter.com/CVEnew/status/2054340917612466510 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054368704939319726 · Twitter Post
• https://t.me/CVEtracker/53585 · Telegram Post