What is the CVSS score of CVE-2026-39330?

CVE-2026-39330 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39330?

ChurchCRM versions prior to 7.1.0 contain a SQL injection vulnerability in the PropertyAssign endpoint that allows privileged authenticated users to execute arbitrary database commands, potentially…. A patch is available.

How to fix or mitigate CVE-2026-39330?

Within 24 hours: Inventory all ChurchCRM deployments and document current versions across your infrastructure. Within 7 days: Apply vendor patch to ChurchCRM 7.1.0 or later on all affected instances after testing in a non-production environment. Within 30 days: Conduct access review to audit 'Manage Groups & Roles' and 'Edit Records' privilege assignments; implement principle of least privilege to minimize blast radius of authenticated SQL injection attacks.

PHP CVE-2026-39330

EUVD-2026-19825 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19825

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:34 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyAssign.php in ChurchCRM. Authenticated users with the role Manage Groups & Roles (ManageGroups) and Edit Records (isEditRecordsEnabled) can inject arbitrary SQL statements through the Value parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM's /PropertyAssign.php endpoint allows authenticated users with 'Manage Groups & Roles' and 'Edit Records' privileges to execute arbitrary SQL commands through the Value parameter. Affecting all versions prior to 7.1.0, attackers can extract sensitive church membership data, modify database records, or potentially achieve complete database compromise. CVSS 8.8 (High) with network-accessible attack vector and low complexity. No public exploit identified at time of analysis, with EPSS data unavailable. Vendor-released patch: version 7.1.0.

Technical ContextAI

This vulnerability affects ChurchCRM, an open-source PHP-based church management system designed for managing member information, donations, events, and administrative functions. The flaw resides in the PropertyAssign.php endpoint, which likely handles custom property assignments for church records (members, groups, families). The root cause is CWE-89 (SQL Injection), indicating insufficient input validation and parameterization of the Value parameter before inclusion in SQL queries. The CPE identifier cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:* confirms this affects the ChurchCRM CRM product line. SQL injection vulnerabilities in PHP applications typically occur when user-supplied data is concatenated directly into SQL queries rather than using prepared statements with bound parameters. Given the context of property assignment functionality, the vulnerable code likely constructs dynamic INSERT or UPDATE statements without proper sanitization, allowing attackers to break out of the intended query structure and execute arbitrary SQL commands against the underlying database (likely MySQL or MariaDB based on typical ChurchCRM deployments).

RemediationAI

Organizations running ChurchCRM must immediately upgrade to version 7.1.0 or later, which contains the vendor-released patch addressing this SQL injection vulnerability. The upgrade should follow ChurchCRM's standard update procedures including database backup prior to migration. Review the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-xq86-jh52-728g for release-specific upgrade instructions and any additional security considerations. As an interim risk mitigation for environments where immediate patching is not feasible, restrict access to the Manage Groups & Roles and Edit Records permissions to only essential trusted administrators, implement network-level access controls to limit exposure of the ChurchCRM installation, enable database query logging to detect potential exploitation attempts, and consider temporarily disabling the PropertyAssign.php functionality if operationally viable. Post-remediation, conduct a security audit of user accounts with elevated permissions and review database logs for suspicious activity patterns that may indicate prior exploitation, particularly looking for unusual SQL syntax or data exfiltration queries in application logs dated before patch deployment.