PT-2026-57859 · Churchcrm · Churchcrm

Published 2026-07-13 · Updated 2026-07-14 · CVE-2026-58408

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.4.0

Description A low-privileged user can bypass the /admin/export UI to exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV file containing the full Personally Identifiable Information (PII) of every Person/Family record in the database. This occurs because the endpoint lacks a dedicated isAdmin() or bExportData authorization check, relying instead on a coarse permission gate that allows any user with at least one non-admin permission to access the bulk-export functionality.

Recommendations Update to version 7.4.0.

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2026-58408

Affected Products

Churchcrm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-58408 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63 · Note
• https://twitter.com/f1tym1/status/2076836488231153920 · Twitter Post
• https://twitter.com/CVEnew/status/2076767959666786665 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076770203489153424 · Twitter Post