What is the CVSS score of CVE-2026-42289?

CVE-2026-42289 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ChurchCRM are affected by CVE-2026-42289?

ChurchCRM versions prior to 7.3.2 contain a CSRF vulnerability in UserEditor.php that enables unauthenticated attackers to trick authenticated administrators into creating unauthorized administrator…

How to fix or mitigate CVE-2026-42289?

Within 24 hours, inventory all ChurchCRM installations and confirm version numbers in use, then enable enhanced logging on all administrative account changes and restrict administrator login to known IP ranges. Within 7 days, implement application-level CSRF protections including CSRF token validation on all UserEditor.php POST endpoints, enforce SameSite=Strict and Secure cookie flags on all session cookies, and configure WAF rules to block cross-origin requests to the UserEditor module. Within 30 days, evaluate options including upgrading ChurchCRM if a patched version becomes available, or migration to alternative systems with confirmed CSRF protections and active security maintenance.

ChurchCRM CVE-2026-42289

HIGH

Improper Privilege Management (CWE-269)

2026-05-12 GitHub_M

PHP Privilege Escalation CSRF Churchcrm Crm

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

CSRF needs no attacker credentials (PR:N) but requires a logged-in admin to visit a malicious page (UI:R); forged privilege change grants full admin, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:11 vuln.today

CVE Published

May 12, 2026 - 22:23 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.

AnalysisAI

Cross-site request forgery in ChurchCRM's UserEditor.php (versions prior to 7.3.2) lets an unauthenticated attacker forge account-management requests that execute with an authenticated administrator's session. Because the endpoint processes user creation and permission changes from $_POST parameters with no CSRF token, a victim admin who visits a malicious page can be tricked into silently promoting a low-privilege user to administrator or minting a new admin backdoor account. Publicly available exploit code exists (SSVC: poc) but the flaw is not in CISA KEV, and EPSS is very low (0.02%, 4th percentile), indicating no evidence of widespread exploitation.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management application (CPE cpe:2.3:a:churchcrm:crm). The affected component, UserEditor.php, handles account creation and permission/role updates but trusts state-changing POST requests without verifying an anti-CSRF token or Origin/Referer, so any request carrying the administrator's session cookie is honored. The root cause maps to CWE-269 (Improper Privilege Management) manifested through a CSRF weakness: the privilege-assignment operation is reachable via forged cross-origin requests, allowing an attacker to control who receives administrator rights. This is a classic session-riding pattern where the browser automatically attaches the victim's authenticated cookie to the attacker-forged form submission.

RemediationAI

Upgrade to ChurchCRM 7.3.2, which adds the missing CSRF protection to UserEditor.php; this is the vendor-released patched version and is the primary fix, as documented in advisory https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3xq9-c86x-cwpp. If immediate upgrade is not possible, reduce exposure by restricting network access to the ChurchCRM admin interface (for example, place it behind a VPN or IP allowlist so administrators do not browse the wider web from the same session context), which limits the chance an admin visits an attacker page while authenticated - the trade-off is reduced convenience for remote administrators. As a browser-side compensating control, administrators should log out of ChurchCRM when not actively using it and avoid opening untrusted links in the same session; SameSite=Strict session cookies at the reverse proxy can also blunt cross-site request delivery, though this may affect legitimate cross-site links into the app. These are stopgaps only - applying the 7.3.2 patch is strongly preferred.