Which versions of ChurchCRM are affected by CVE-2025-67875?

ChurchCRM versions prior to 6.5.3 carry a high-severity flaw that can let a lower-privileged insider with specific permissions hijack an administrator's session and achieve full account takeover,…

Is there a public PoC exploit available for CVE-2025-67875?

Yes, a public proof-of-concept exploit is available for CVE-2025-67875. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-67875?

Within 24 hours, inventory all ChurchCRM instances and confirm whether they run versions prior to 6.5.3; remove the 'Edit Records' and 'Manage Properties and Classifications' permissions from all non-administrative and untrusted accounts, audit any accounts holding both permissions, and review administrator profiles for unauthorized changes. Within 7 days, if a vendor-released fixed version such as ChurchCRM 6.5.3 or later becomes available, test and deploy it; until then, enforce least privilege, enable enhanced logging and alerting for administrator profile edits and session anomalies, shorten session timeouts, and consider a reverse proxy or WAF rule to block suspicious stored payloads targeting profile endpoints. Within 30 days, complete a full access-control review for ChurchCRM, rotate credentials and invalidate active sessions for any suspected administrator accounts, validate that only trusted administrators retain elevated permissions, and establish recurring monitoring of ChurchCRM security advisories for a patch release.

ChurchCRM CVE-2025-67875

Q: What is the CVSS score of CVE-2025-67875?

CVE-2025-67875 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-17 security-advisories@github.com

XSS Privilege Escalation Churchcrm

8.5

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Authenticated mid-privilege user (PR:L) plants stored XSS requiring admin to view the page (UI:R); execution in the admin's session across a privilege boundary is a scope change (S:C) yielding full account takeover (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 23:42 vuln.today

CVE Published

Dec 17, 2025 - 22:16 cve.org

HIGH 8.5

DescriptionCVE.org

ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. The payload executes when the administrator views their own profile page, allowing the attacker to hijack the administrator's session, perform administrative actions, and achieve a full account takeover. This vulnerability is a combination of two separate flaws: an Insecure Direct Object Reference (IDOR) that allows any user to view any other user's profile, and a Broken Access Control vulnerability that allows a user with general edit permissions to modify any other user's record properties. Version 6.5.3 fixes the issue.

AnalysisAI

Stored cross-site scripting combined with an IDOR and broken access control in ChurchCRM versions prior to 6.5.3 enables an authenticated user with both 'Edit Records' and 'Manage Properties and Classifications' permissions to inject a persistent payload into an administrator's profile, which executes when that administrator views their own profile page. Successful exploitation can hijack the administrator's session and lead to full account takeover, but requires the targeted administrator to actively view the profile and is limited to malicious or compromised lower-privileged insiders on unpatched instances. Publicly available exploit code exists; the CVE is not in CISA KEV, and the overall real-world risk is assessed as moderate.

Technical ContextAI

The vulnerability class is CWE-79 (improper neutralization of input during web page generation, i.e., stored XSS), compounded by an insecure direct object reference that lets any user view any other user's profile and a broken access control flaw that lets users with general edit permissions modify any other user's record properties. The affected product family is ChurchCRM, tracked by the blanket CPE cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* for all versions before 6.5.3. The CVSS 4.0 vector shows PR:L (authenticated attacker) and UI:A (admin must actively view the profile), and the independent assessment uses CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C with high confidentiality, integrity, and availability impact because the XSS executes in the administrator's session and can cross privilege boundaries. Because the injected script runs in the administrator's browser context, the attacker can perform administrative actions as that admin, but the initial access requires the specific mid-level permission pair and relies on the admin subsequently navigating to the poisoned profile page.

RemediationAI

Upgrade to ChurchCRM 6.5.3 or later (vendor-released patch: 6.5.3) as the definitive fix; see the vendor advisory https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjm. If immediate upgrade is not possible, remove the 'Edit Records' and 'Manage Properties and Classifications' permissions from all but the most trusted users - this directly blocks the required privilege combination but may disrupt legitimate data-entry workflows, so review role mappings first. Additionally, restrict administrative profile access or require administrators to re-authenticate before sensitive actions, and consider WAF rules to block stored XSS payloads in profile fields; WAF tuning carries false-positive and maintenance trade-offs and is not a substitute for patching. Monitor admin profile changes and session anomalies for signs of exploitation.