Which versions of Crm are affected by CVE-2026-35572?

ChurchCRM versions before 6.5.3 contain a server-side request forgery vulnerability that allows authenticated administrators to send arbitrary outbound requests, enabling internal network…. A patch is available.

How to fix or mitigate CVE-2026-35572?

Within 24 hours: Identify all ChurchCRM instances and document current versions. Within 7 days: Upgrade ChurchCRM to version 6.5.3 or later on all affected systems; verify patch installation by confirming version number in application settings. Within 30 days: Conduct access review of administrative accounts, implement network segmentation to restrict outbound requests from ChurchCRM servers, and enable HTTP request logging for audit trails.

Crm CVE-2026-35572

Q: What is the CVSS score of CVE-2026-35572?

CVE-2026-35572 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19770 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-07 GitHub_M

SSRF Crm

7.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5.3

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19770

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:07 nvd

HIGH 7.0

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS requests to arbitrary hosts (SSRF) by supplying a crafted URL in the Referer request header. The server subsequently makes an outbound request to the attacker-controlled domain, confirmed via OAST. This vulnerability is fixed in 6.5.3.

AnalysisAI

Server-Side Request Forgery in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to trigger outbound HTTP/HTTPS requests to arbitrary external hosts by injecting malicious URLs into the Referer header. Attackers with high-privilege access can exploit this to probe internal networks, exfiltrate data, or interact with cloud metadata services. CVSS 7.0 reflects medium-high severity requiring privileged access (PR:H). No public exploit identified at time of analysis, though SSRF exploitation techniques are well-documented. EPSS data not provided, but the requirement for admin credentials significantly reduces real-world attack surface compared to unauthenticated SSRF vulnerabilities.

Technical ContextAI

This vulnerability stems from improper validation of user-supplied input in the Referer HTTP header (CWE-918: Server-Side Request Forgery). ChurchCRM, an open-source church management system built on PHP, fails to sanitize or validate the Referer header before using it to construct outbound HTTP/HTTPS requests. The affected component (cpe:2.3:a:churchcrm:crm) processes the attacker-controlled Referer value and initiates server-side requests to the specified domain, confirmed through Out-of-Band Application Security Testing (OAST) techniques. SSRF vulnerabilities of this class enable attackers to abuse the server's network position to access internal resources, bypass firewall restrictions, or interact with cloud provider metadata endpoints (e.g., AWS EC2 metadata at 169.254.169.254). The CVSS 4.0 vector indicates network-based attack (AV:N), low complexity (AC:L), and high confidentiality impact (VC:H) with limited integrity and availability impacts.

RemediationAI

Upgrade ChurchCRM to version 6.5.3 or later, which contains vendor-released patches addressing the Referer header validation flaw. The fix is available through the official GitHub repository at https://github.com/ChurchCRM/CRM with details in security advisory GHSA-44x3-28jv-mrwq. Organizations unable to immediately upgrade should implement compensating controls including strict input validation on all HTTP headers at the web application firewall or reverse proxy layer, network egress filtering to block outbound requests from the application server to RFC 1918 private address spaces and cloud metadata endpoints (169.254.169.254, fd00::/8), and enhanced monitoring of administrator account activity for anomalous Referer header patterns. Review and restrict administrative privileges following least-privilege principles to minimize the pool of accounts capable of exploiting this vulnerability. Validate no unauthorized modifications have been made via the Referer injection vector by auditing server-side request logs for unexpected outbound connections during the exposure window.