ChurchCRM CVE-2026-40485

The vulnerability requires the ChurchCRM public API login endpoint (/api/public/user/login) to be exposed and accessible over the network. This endpoint is public by design, requiring no prior authentication or special configuration to access. The vulnerability is triggered by sending any HTTP request (typically POST) to this endpoint with a username in the request body. No user interaction is required. Exploitation is limited only by network reachability; if the endpoint is behind a firewall, on an internal network, or protected by a WAF with rate limiting, the attack surface is reduced. However, the absence of rate limiting and account lockout in the vulnerable code means that on default or publicly exposed installations, enumeration can proceed freely.

CVSS 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:L correctly characterizes this as a low-confidentiality information disclosure with remote, unauthenticated network access and no special conditions required. The vulnerability presents moderate real-world risk because username enumeration is a foundational step in credential-stuffing and targeted phishing campaigns. However, the impact is strictly informational (C:L) with no integrity or availability damage, and requires active enumeration by an attacker. The absence of KEV status or public exploit code suggests this vulnerability has not been subject to widespread active exploitation or automated weaponization at the time of analysis. Risk is elevated in environments where usernames correspond to predictable identifiers (e.g., email addresses, staff directories) and where user lists are otherwise confidential. Organizations with exposed ChurchCRM deployments should prioritize patching to deny attackers preliminary reconnaissance data.

An attacker performs reconnaissance on a ChurchCRM instance by sending HTTP POST requests to /api/public/user/login with common usernames (e.g., admin, pastor, john.doe). For each request, the attacker notes the HTTP response code: 404 indicates the username is not in the system, while 401 indicates the username exists. The attacker iterates through a list of 1,000+ potential usernames in minutes without triggering any rate limiting or lockout, building a roster of valid accounts. This enumerated list is then used for credential stuffing attacks using leaked password databases or for targeted phishing emails that appear to come from within the organization.