Incomplete fix for authentication bypass in ChurchCRM public API (CVE-2026-44547)

The fix for CVE-2026-40582, which addressed 2FA bypass and account lockout bypass in ChurchCRM's public API login endpoint, was never delivered to users. The hardening commit was silently overwritten by an unrelated pull request before any 7.2.x release tag was cut, leaving all shipped 7.2.x versions exploitable by the previously published proof-of-concept. Affected versions: - >= 7.2.0, <= 7.2.2 We recommend updating to: 7.3.1. CVSS 9.6 · our assessment: act_now Reference: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cwp8-rm8g-q5c9 Details: https://vuln.today/cve/CVE-2026-44547