What is the CVSS score of CVE-2026-39317?

CVE-2026-39317 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39317?

ChurchCRM versions before 7.1.0 contain a SQL injection vulnerability in SettingsIndividual.php that allows authenticated users with low-privilege accounts to extract sensitive organizational data,…. A patch is available.

How to fix or mitigate CVE-2026-39317?

Within 24 hours: Identify all ChurchCRM installations and document current versions via admin panel or database queries. Within 7 days: Upgrade all instances to ChurchCRM 7.1.0 or later; test in staging environment first, then deploy to production during maintenance window with full backup. Within 30 days: Audit database access logs for suspicious SQL activity; review member accounts for unauthorized access; notify affected members if any unauthorized data access is confirmed during investigation.

PHP CVE-2026-39317

EUVD-2026-19807 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

Information Disclosure PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19807

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:20 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in ChurchCRM's SettingsIndividual.php where user-controlled array keys from the type POST parameter are used directly in SQL queries without sanitization. This allows any authenticated user to extract sensitive data from the database. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM's SettingsIndividual.php allows authenticated users to extract sensitive database contents including member personal information, financial records, and credentials. Affecting all versions prior to 7.1.0, attackers with low-privilege accounts can escalate to full database compromise via unsanitized POST parameter array keys used directly in SQL queries. EPSS data not available, but the low attack complexity (AC:L) and network accessibility (AV:N) combined with publicly disclosed technical details create elevated risk for exposed installations. Vendor-released patch available in version 7.1.0.

Technical ContextAI

This vulnerability resides in ChurchCRM's SettingsIndividual.php endpoint, a PHP-based component handling user preference settings. The flaw stems from CWE-89 (SQL Injection) where the application accepts POST parameters containing array structures and directly interpolates the array keys into SQL query construction without parameterization or input validation. In PHP applications, array keys from user input are commonly overlooked as injection vectors since developers focus on sanitizing values rather than structural elements. ChurchCRM is a specialized church management system storing highly sensitive personally identifiable information including member contact details, donation records, pastoral notes, and family relationships. The CPE identifier cpe:2.3:a:churchcrm:crm confirms the affected product spans all pre-7.1.0 versions of the ChurchCRM application. SQL injection at the array key level is particularly dangerous because it bypasses many naive sanitization attempts that only filter values, allowing attackers to inject UNION queries, stacked commands, or time-based blind extraction techniques.

RemediationAI

Immediately upgrade to ChurchCRM version 7.1.0 which contains parameterized query implementations that eliminate the SQL injection vector in SettingsIndividual.php. The vendor-released patch is available through the official ChurchCRM GitHub repository at https://github.com/ChurchCRM/CRM with installation instructions in the security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-h7hg-f7cw-9xwc. Organizations unable to immediately upgrade should implement compensating controls including restricting network access to the ChurchCRM application via IP allowlisting, enforcing strong authentication policies, auditing existing user accounts for unauthorized access, and monitoring database query logs for anomalous SELECT statements or UNION operations. As a temporary mitigation, consider disabling the SettingsIndividual.php endpoint at the web server level if user preference modification is not operationally critical, though this does not address potential similar vulnerabilities in other components. Post-remediation, conduct a security review of all user accounts and audit database access logs for the period the system was vulnerable to identify potential compromise, particularly reviewing extraction of member contact tables and financial records.