Churchcrm CVE-2026-39339

Remote unauthenticated attacker exploits ChurchCRM versions prior to 7.1.0 by including 'api/public' anywhere in API request URL to bypass AuthMiddleware.php authentication checks. No victim interaction required. Default configurations affected.

This vulnerability presents critical real-world risk despite absence of confirmed active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible attack requiring no privileges, low complexity, and no user interaction-characteristics highly favorable for mass exploitation. Attack complexity is minimal, requiring only HTTP request manipulation with 'api/public' string injection. SSVC framework assessment indicates high technical impact (complete confidentiality and integrity compromise of church member data) with potentially automatable exploitation given the simplicity of the bypass technique. Primary risk factors include: (1) ChurchCRM installations commonly internet-exposed for member self-service portals, (2) church databases contain highly sensitive personal information including addresses, phone numbers, financial contributions, and family relationships, (3) trivial exploitation requiring no specialized tools beyond curl or web browsers. Mitigating factors: relatively small attack surface limited to ChurchCRM installations, niche application domain may limit attacker awareness. The combination of critical CVSS score, no authentication requirement, and low attack complexity makes this a genuine priority for affected organizations despite no KEV listing.

An external attacker scans the internet for ChurchCRM installations using Shodan or similar reconnaissance tools, identifying instances by characteristic login pages or HTTP headers. The attacker crafts HTTP requests to protected API endpoints such as '/api/members/list' but injects 'api/public' into the URL path (e.g., '/api/public/../members/list' or '/api/members/list?path=api/public'). The flawed authentication middleware incorrectly validates this manipulated request as accessing public endpoints, bypassing authentication entirely. The attacker systematically enumerates all API endpoints, extracting complete member directories with names, addresses, phone numbers, email addresses, donation histories, and family relationship data. This information could be monetized through identity theft, targeted phishing campaigns against church members, or sold on dark web marketplaces. No public exploit code confirmed at time of analysis, though the trivial nature of URL manipulation makes proof-of-concept development straightforward for attackers with basic HTTP knowledge.