What is the CVSS score of CVE-2026-39341?

CVE-2026-39341 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39341?

ChurchCRM versions before 7.1.0 contain a SQL injection vulnerability in the ConfirmReportEmail.php endpoint that allows authenticated users with low-privilege accounts to extract sensitive database…. A patch is available.

How to fix or mitigate CVE-2026-39341?

Within 24 hours: identify all ChurchCRM instances and document current versions via administrative interface or direct database query. Within 7 days: upgrade all ChurchCRM installations to version 7.1.0 or later; test in non-production environment first. Within 30 days: conduct database access logs review for the ConfirmReportEmail.php endpoint to identify any unauthorized query patterns; reset credentials for all low-privilege accounts as precaution.

PHP CVE-2026-39341

EUVD-2026-19843 HIGH

SQL Injection (CWE-89)

2026-04-07 security-advisories@github.com

PHP SQLi

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

Re-analysis Queued

Apr 15, 2026 - 20:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19843

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, The application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not used to create the SQL query. This vulnerability is fixed in 7.1.0.

AnalysisAI

Time-based SQL injection in ChurchCRM versions before 7.1.0 allows authenticated remote attackers to extract sensitive database contents through the ConfirmReportEmail.php endpoint. The familyId parameter fails to properly sanitize user input in SQL query construction, enabling attackers with low-privilege accounts to exfiltrate high-value data including confidential church member information. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though the vulnerability class (CWE-89) is well-understood and exploitation techniques are widely documented.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system designed to track member information, donations, and family records. This vulnerability stems from classic SQL injection (CWE-89) in the Reports/ConfirmReportEmail.php endpoint where the familyId GET parameter undergoes sanitization, but the sanitized value is never actually incorporated into the SQL query construction-the original unsanitized input is used instead. The time-based nature indicates attackers can use SQL timing functions (such as SLEEP() in MySQL or WAITFOR in SQL Server) to infer database contents character-by-character through boolean-blind techniques. This architectural flaw completely bypasses input validation controls, transforming a defensive measure into security theater while the vulnerable code path remains exploitable.

RemediationAI

Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains a complete fix for the SQL injection vulnerability through proper parameterized query implementation in the ConfirmReportEmail.php endpoint. The vendor-released patch is available through the official ChurchCRM GitHub repository. Organizations unable to upgrade immediately should implement compensating controls including restricting access to the Reports/ConfirmReportEmail.php endpoint through web application firewall rules, implementing strict input validation at the network perimeter, and conducting enhanced monitoring of database query logs for suspicious timing patterns or unusual familyId parameter values. However, these workarounds provide incomplete protection and should be considered temporary measures only. Review application logs for evidence of exploitation attempts targeting the familyId parameter with SQL metacharacters or timing functions. Conduct a security assessment of database permissions to ensure application accounts follow least-privilege principles. Full remediation details are available in the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3h69-vjff-jj5c.