What is the CVSS score of CVE-2026-39339?

CVE-2026-39339 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-39339?

ChurchCRM versions before 7.1.0 contain a critical authentication bypass in the API middleware that allows unauthenticated attackers to access protected endpoints by manipulating URL paths,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-39339?

Yes, a public proof-of-concept exploit is available for CVE-2026-39339. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-39339?

Within 24 hours: identify all ChurchCRM instances in your environment and document current versions; verify network access controls restricting API endpoints to authorized users only. Within 7 days: upgrade all ChurchCRM deployments to version 7.1.0 or later; test API endpoints post-upgrade to confirm authentication enforcement. Within 30 days: conduct audit of API access logs for indicators of path manipulation exploitation; review member data access for unauthorized access events during the vulnerability window.

PHP CVE-2026-39339

EUVD-2026-19839 CRITICAL

Improper Access Control (CWE-284)

2026-04-07 security-advisories@github.com

PHP Authentication Bypass Churchcrm

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19839

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.

AnalysisAI

Authentication bypass in ChurchCRM API middleware enables unauthenticated remote attackers to access all protected endpoints by manipulating URL paths with 'api/public' strings, exposing complete church member databases and system configurations. Affects ChurchCRM versions prior to 7.1.0 with critical CVSS 9.1 rating. EPSS exploitation probability data unavailable; no public exploit code confirmed at time of analysis, though the trivial attack complexity (path manipulation) significantly increases exploitation risk for internet-exposed installations.

Technical ContextAI

ChurchCRM is an open-source PHP-based church management platform handling sensitive member information, financial records, and organizational data. The vulnerability resides in the Slim framework-based API middleware component (AuthMiddleware.php) responsible for enforcing authentication boundaries between public and protected API routes. CWE-284 (Improper Access Control) manifests through flawed URL pattern matching logic that incorrectly validates authentication requirements. The middleware appears to perform substring matching rather than proper path segment validation, allowing attackers to inject 'api/public' anywhere in request URLs to bypass authentication checks. This represents a fundamental authentication boundary failure where path-based security controls can be trivially circumvented through URL manipulation without cryptographic attacks or credential compromise.

RemediationAI

Immediately upgrade to ChurchCRM version 7.1.0 which contains the authentication bypass fix. Organizations should prioritize this upgrade as a critical security patch given the complete authentication boundary failure. Download the patched version from the official ChurchCRM GitHub repository and follow standard upgrade procedures including database backup prior to migration. For installations unable to immediately upgrade, implement network-level access controls such as firewall rules restricting API endpoint access to trusted IP addresses, or place the ChurchCRM instance behind a web application firewall (WAF) with strict URL path validation rules blocking requests containing 'api/public' in non-legitimate contexts. However, these workarounds are temporary mitigations only-the underlying code-level vulnerability requires the vendor patch. Post-upgrade, review web server access logs for suspicious API requests containing 'api/public' path manipulation patterns to identify potential prior exploitation. Consult the vendor advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc for additional upgrade guidance and security recommendations.