ChurchCRM CVE-2026-40582

Requires valid username and password credentials for any ChurchCRM user account. The vulnerability bypasses account lockout status and two-factor authentication, meaning an attacker needs only the password itself - not active session tokens, 2FA codes, or access to a non-locked account state. Exploitation succeeds against accounts protected by 2FA or currently locked due to failed login attempts, which would normally block authentication through the standard login interface. Network access to the /api/public/user/login endpoint is required (AV:N), but no special ChurchCRM configuration or non-default settings are necessary - the vulnerable endpoint is present in default installations prior to version 7.2.0. Does require attacker to obtain credentials through external means such as phishing, credential stuffing, password reuse from other breaches, or social engineering, as the endpoint does not itself leak credentials.

Real-world risk is high for environments where ChurchCRM credentials have been compromised through phishing, password reuse, or third-party breaches. The CVSS 9.1 critical score accurately reflects the severity when credentials are available: network-based attack vector (AV:N), low complexity (AC:L), no privileges required beyond stolen credentials (PR:N), high confidentiality and integrity impact (VC:H/VI:H). The AT:P (Attack Requirements: Present) metric suggests the attacker needs valid credentials, which is the primary limiting factor. No CISA KEV listing indicates no confirmed widespread exploitation in the wild, but this is likely due to ChurchCRM's limited deployment scope rather than inherent difficulty. The vulnerability is trivial to exploit once credentials are obtained - a simple API call bypasses lockout and 2FA. EPSS data not provided, but the attack pattern is well-documented and easily automated. Organizations using ChurchCRM should treat this as a high priority if credential theft vectors exist (phishing susceptibility, shared passwords, previous breaches). The vulnerability effectively nullifies two critical security controls (account lockout and 2FA), transforming any credential compromise into full API access.

An attacker obtains a ChurchCRM administrator's username and password through a credential stuffing attack using passwords leaked from an unrelated service breach. Despite the administrator enabling two-factor authentication and the account being temporarily locked after previous failed login attempts, the attacker sends a POST request directly to https://church.example.org/api/public/user/login with the stolen credentials. The endpoint validates only the password, bypasses 2FA and lockout checks, and returns a valid API key. The attacker uses this key to access protected API endpoints, exfiltrating member contact information, donation records, and financial data with full administrator privileges.