What is the CVSS score of CVE-2026-44547?

CVE-2026-44547 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of ChurchCRM are affected by CVE-2026-44547?

ChurchCRM versions 7.2.0 through 7.2.2 contain a re-introduced authentication bypass enabling unauthorized access to member records, donor information, and administrative functions.

How to fix or mitigate CVE-2026-44547?

Within 24 hours, inventory all ChurchCRM instances and identify those running versions 7.2.0, 7.2.1, or 7.2.2 via system records or API version checks; restrict API access via firewall rules as a precaution. Within 7 days, upgrade all affected instances to ChurchCRM 7.3.1, testing thoroughly in a staging environment to validate compatibility with local customizations and existing data before production deployment. Within 30 days, audit application logs for suspicious API access patterns over the past 90 days, document any unauthorized access discovered, and enforce password resets for any member accounts that may have been accessed during the vulnerability window.

ChurchCRM CVE-2026-44547

CRITICAL

Improper Authentication (CWE-287)

2026-05-12 GitHub_M

PHP Authentication Bypass Churchcrm Crm

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Network-reachable API login route with low complexity; PR:L because the description and CVSS indicate low-privilege access is needed; scope-changed auth bypass yields high C/I, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 19:05 vuln.today

Analysis Generated

Jul 23, 2026 - 19:05 vuln.today

CVE Published

May 12, 2026 - 22:30 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.

AnalysisAI

Authentication bypass in ChurchCRM 7.2.0 through 7.2.2 re-exposes a previously patched flaw (CVE-2026-4058) because the hardening applied to src/api/routes/public/public-user.php was silently removed by an unrelated pull request before any 7.2.x tag was cut. As a result, every shipped 7.2.x release is exploitable using the PoC published with the original advisory, letting an attacker with low-level access defeat the API login endpoint's protections to reach protected data and functions. Publicly available exploit code exists (SSVC: PoC), but EPSS is very low (0.03%) and the flaw is not on the CISA KEV list; fixed in 7.3.1.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system (cpe:2.3:a:churchcrm:crm). The weakness is CWE-287 (Improper Authentication) in the public API login route implemented in src/api/routes/public/public-user.php. The original CVE-2026-4058 fix added authentication hardening to that endpoint - per the advisory workflow notes this centered on 2FA/account-lockout enforcement and generic error handling to prevent username enumeration. That hardening commit was merged but then stripped by an unrelated PR, so the protective control never made it into a tagged 7.2.x build. The result is a regression: the endpoint reverts to its pre-fix, weakly-authenticated behavior, which is exactly the class of authentication-mechanism failure CWE-287 describes.

RemediationAI

Vendor-released patch: upgrade to ChurchCRM 7.3.1, which restores the authentication hardening to src/api/routes/public/public-user.php that was stripped from the 7.2.x line. See the advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cwp8-rm8g-q5c9 and the remediation pull request https://github.com/ChurchCRM/CRM/pull/8855. If you cannot upgrade immediately, restrict network access to the /api/public/user/login endpoint - for example place the application behind a VPN or IP allow-list, or use a WAF/reverse-proxy rule to rate-limit and block repeated calls to that route (trade-off: this can interfere with legitimate remote/mobile API clients and does not restore 2FA/lockout logic). As a further compensating control, enforce strong, rotated administrative credentials and monitor authentication logs for enumeration or brute-force patterns against the API login route, since the removed hardening previously provided lockout and generic error responses.