What is the CVSS score of CVE-2026-35567?

CVE-2026-35567 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-35567?

ChurchCRM versions before 7.1.0 contain a SQL injection vulnerability that allows authenticated users with ManageGroups role to compromise the entire database, exposing all member records and…. A patch is available.

How to fix or mitigate CVE-2026-35567?

Within 24 hours: Identify all ChurchCRM instances and current versions in your environment. Within 7 days: Upgrade all affected ChurchCRM installations to version 7.1.0 or later. Within 30 days: Audit access logs for unauthorized SQL activity targeting MemberRoleChange.php and review user permissions to ensure least-privilege access to ManageGroups role.

PHP CVE-2026-35567

EUVD-2026-19722 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

SQLi PHP

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 16:00 euvd

EUVD-2026-19722

Analysis Generated

Apr 07, 2026 - 16:00 vuln.today

CVE Published

Apr 07, 2026 - 15:49 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, the NewRole POST parameter in src/MemberRoleChange.php is used in an SQL query without proper integer validation, allowing authenticated users to inject arbitrary SQL. The attack requires an authenticated session with ManageGroups role, knowledge of a valid GroupID and PersonID (obtainable from GroupView or PersonView pages) This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with ManageGroups role to execute arbitrary SQL commands via the NewRole POST parameter in MemberRoleChange.php. The vulnerability requires low-privilege authentication (PR:L) but permits complete database compromise with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation confirmed at time of analysis, though the attack complexity is low (AC:L) and requires no user interaction.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in ChurchCRM's role management functionality. The affected component src/MemberRoleChange.php accepts the NewRole POST parameter and incorporates it directly into SQL queries without proper integer validation or parameterized query usage. ChurchCRM is a PHP-based church management system (cpe:2.3:a:churchcrm:crm), and this vulnerability exists in the member role modification workflow. SQL injection occurs when user-controlled input is concatenated into SQL statements rather than being bound as parameters, allowing attackers to break out of the intended query context and execute arbitrary SQL commands. The vulnerability is scoped to the web application (S:U) and exploitable over the network (AV:N), making it accessible to any authenticated user with the ManageGroups permission who can reach the vulnerable endpoint.

RemediationAI

Upgrade to ChurchCRM version 7.1.0 or later, which contains the vendor-released patch addressing the SQL injection vulnerability in MemberRoleChange.php. Organizations should prioritize this upgrade for any internet-facing installations or environments where authenticated users may be untrusted. As an interim mitigation, restrict the ManageGroups role to only highly trusted administrators and monitor database query logs for suspicious SQL syntax in role change operations. Review user accounts with ManageGroups permissions and remove this role from any accounts that do not require it. Consult the GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-5f97-jgg4-gqwr for additional vendor guidance and confirmation of the fix in version 7.1.0.