What is the CVSS score of CVE-2026-36748?

CVE-2026-36748 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of RockRMS are affected by CVE-2026-36748?

RockRMS church management systems (versions 16.13-17.7.0) contain a critical vulnerability allowing authenticated users to compromise administrator accounts and gain full system control.

How to fix or mitigate CVE-2026-36748?

Within 24 hours: Audit all RockRMS deployments to identify version numbers and assess administrator user exposure in the organization. Within 7 days: Restrict administrator access to user profile viewing, enforce multi-factor authentication for all administrative accounts, and disable the Social Media links field if operationally feasible. Within 30 days: Monitor Raxis and RockRMS vendor communications for patch release; plan upgrade to version 17.7.1 or later when available.

RockRMS CVE-2026-36748

EUVD-2026-34100 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-03 mitre

GHSA-378r-5qcc-x537

XSS N A

9.0

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 19:23 vuln.today

CVSS changed

Jun 03, 2026 - 19:22 NVD

9.0 (CRITICAL)

CVE Published

Jun 03, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.

AnalysisAI

Stored cross-site scripting in RockRMS versions 16.13 and earlier through 17.7.0 allows authenticated attackers to inject malicious JavaScript via the Social Media links field in user profiles, leading to privilege escalation when administrators view the profile. According to the Raxis disclosure referenced in this CVE, the flaw enables session hijacking and account takeover of higher-privileged users. There is no public exploit identified at time of analysis, but a detailed technical write-up is publicly available describing the attack path.

Technical ContextAI

RockRMS (Rock Relationship Management System) is an open-source church/relationship management platform maintained by the Spark Development Network, commonly used by religious organizations to manage membership, donations, and communications. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the Social Media links field on user profile pages fails to sanitize or encode user-supplied URLs before rendering them in HTML context. Because profile pages are rendered for other users (including administrators), an injected payload such as a javascript: URI or event-handler attribute executes in the victim's browser session within the same origin as the RockRMS web application.

RemediationAI

Upgrade to RockRMS version 17.7.0 or later, which per the CVE description contains the fix for this stored XSS in the Social Media links profile field. No vendor advisory URL was provided in the CVE references beyond the Spark Development Network homepage (http://sparkdevnetwork.com) and the Raxis disclosure (https://raxis.com/blog/cve-2026-36748-xss-in-rock-rms-leads-to-privilege-escalation/), so administrators should check the Spark Development Network release notes directly for the patched build. If immediate upgrade is not possible, compensating controls include disabling user self-registration to reduce the pool of attackers who can create profiles, removing or restricting the Social Media links field in the user profile configuration, instructing administrators to avoid viewing untrusted user profiles until patched, and deploying a strict Content Security Policy that blocks inline script execution and disallows javascript: URIs - note that aggressive CSP may break legitimate RockRMS features that rely on inline scripts and should be tested in staging.