What is the CVSS score of CVE-2026-39326?

CVE-2026-39326 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39326?

ChurchCRM versions prior to 7.1.0 contain a SQL injection vulnerability in PropertyTypeEditor.php that allows authenticated users with menu privileges to execute arbitrary database commands,…. A patch is available.

How to fix or mitigate CVE-2026-39326?

Within 24 hours: Identify all ChurchCRM instances in your environment and document current versions. Within 7 days: Apply vendor patch to upgrade all ChurchCRM installations to version 7.1.0 or later, and audit user account privileges to remove unnecessary menu options access from non-administrative staff. Within 30 days: Review database access logs for suspicious SQL activity from authenticated accounts, and conduct a data integrity audit to detect unauthorized modifications.

PHP CVE-2026-39326

EUVD-2026-19811 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19811

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:30 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyTypeEditor.php in ChurchCRM. Authenticated users with the role isMenuOptionsEnabled can inject arbitrary SQL statements through the Name and Description parameters and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM PropertyTypeEditor.php allows authenticated users with menu options privileges to execute arbitrary SQL commands via Name and Description parameters, enabling full database compromise including data extraction and modification. Affects all versions before 7.1.0. CVSS 8.8 (High) with network-accessible attack vector requiring low-privilege authentication. EPSS data not available; no confirmed active exploitation (not in CISA KEV), but publicly disclosed via GitHub Security Advisory increases likelihood of future exploitation attempts.

Technical ContextAI

This is a classic server-side SQL injection (CWE-89) vulnerability in ChurchCRM, a PHP-based open-source church management application. The flaw exists in the PropertyTypeEditor.php endpoint, which fails to properly sanitize user-supplied input in the Name and Description parameters before incorporating them into SQL queries. SQL injection occurs when untrusted data is concatenated directly into SQL statements without parameterization or proper escaping, allowing attackers to break out of the intended query context and execute arbitrary SQL commands. The vulnerability requires the isMenuOptionsEnabled role permission, indicating it affects administrative or configuration-level functionality within the property type management module. Given ChurchCRM's purpose as a database-driven CRM system storing sensitive congregation data (personal information, donations, pastoral records), successful exploitation could expose highly sensitive personal and financial information.

RemediationAI

Vendor-released patch: ChurchCRM version 7.1.0 completely remediates this SQL injection vulnerability. Organizations should immediately upgrade to version 7.1.0 or later following standard change management procedures including pre-upgrade backup of database and application files. Download the patched version from the official ChurchCRM GitHub repository and follow upgrade documentation at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-mch7-6v8f-c4j5. As a temporary risk reduction measure while planning upgrades, organizations may restrict the isMenuOptionsEnabled role to only absolutely essential administrative accounts and implement enhanced monitoring of PropertyTypeEditor.php access logs for suspicious SQL syntax patterns in Name and Description fields. However, role restriction is not a substitute for patching as it only reduces attack surface rather than eliminating the vulnerability. No effective workaround exists that maintains full application functionality while completely preventing exploitation.