What is the CVSS score of CVE-2026-39331?

CVE-2026-39331 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Crm are affected by CVE-2026-39331?

ChurchCRM versions prior to 7.1.0 contain an authentication bypass vulnerability in the API that allows any authenticated user to modify family records belonging to other organizations, including…. A patch is available.

How to fix or mitigate CVE-2026-39331?

Within 24 hours: inventory all ChurchCRM instances in production and identify current versions. Within 7 days: apply vendor patch to ChurchCRM 7.1.0 or later on all affected systems, prioritizing instances with external API access. Within 30 days: conduct access audit of API credentials issued to third-party integrations and implement additional authorization controls (role-based access, API scopes) to limit blast radius if credentials are compromised.

Crm CVE-2026-39331

EUVD-2026-19826 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-07 GitHub_M

Authentication Bypass Crm

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19826

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:36 nvd

HIGH 8.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorization by simply changing the {familyId} parameter in requests, regardless of whether they possess the required EditRecords privilege. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, and /family/{familyId}/geocode lack role-based access control, allowing users to deactivate/reactivate arbitrary families, spam verification emails, and mark families as verified and trigger geocoding. This vulnerability is fixed in 7.1.0.

AnalysisAI

Insecure Direct Object Reference (IDOR) in ChurchCRM API allows authenticated low-privilege users to manipulate arbitrary family records without proper authorization checks. Attackers with any valid API credentials can modify family verification status, trigger spam emails, activate/deactivate accounts, and force geocoding operations on any family record by manipulating the familyId parameter in API requests. Affects all ChurchCRM versions prior to 7.1.0. CVSS 8.1 (High) reflects the network-accessible attack vector with low complexity and high integrity/availability impact. No evidence of active exploitation (CISA KEV negative) or public exploit code at time of analysis, but the vulnerability is trivially exploitable given the low attack complexity and published security advisory.

Technical ContextAI

ChurchCRM (CPE: cpe:2.3:a:churchcrm:crm) is an open-source church management platform providing family and member record management through web-based APIs. This vulnerability manifests as CWE-639 (Authorization Bypass Through User-Controlled Key), a classic Insecure Direct Object Reference pattern. Five API endpoints (/family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, /family/{familyId}/geocode) accept user-supplied familyId parameters without validating whether the authenticated user has authorization to access or modify those specific family records. The endpoints fail to implement proper role-based access control (RBAC) checks, specifically neglecting to verify the EditRecords privilege that should gate these operations. This allows horizontal privilege escalation where any authenticated API user can enumerate and manipulate family records belonging to other church members by iterating through familyId values, bypassing the intended authorization boundary between families.

RemediationAI

Upgrade to ChurchCRM version 7.1.0 immediately, which contains authorization checks on the vulnerable API endpoints to validate user permissions before processing family record modifications. The vendor-released patch in 7.1.0 implements proper role-based access control validation that verifies EditRecords privileges and family ownership before allowing state changes. Organizations should update all ChurchCRM installations following standard upgrade procedures documented at the project repository. For environments where immediate patching is not feasible, implement compensating controls including restricting API access to only trusted administrative users, enabling comprehensive API audit logging to detect unauthorized family record access attempts, and monitoring for anomalous patterns such as rapid sequential requests to family endpoints with varying familyId parameters. Review application logs for potential exploitation attempts prior to patching, looking for suspicious API calls to /family/{familyId}/verify, /family/{familyId}/activate, and /family/{familyId}/geocode endpoints from non-administrative accounts. Consult the official security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5 for additional vendor guidance and patch verification procedures.