What is the CVSS score of CVE-2026-44548?

CVE-2026-44548 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ChurchCRM are affected by CVE-2026-44548?

ChurchCRM versions before 7.3.2 contain a vulnerability allowing attackers to trick authenticated staff or volunteers into silently deleting critical records-fundraisers, property assignments, and…

How to fix or mitigate CVE-2026-44548?

Within 24 hours, audit ChurchCRM deletion logs for suspicious patterns and implement network controls to reduce external webpage access from ChurchCRM sessions where feasible. Within 7 days, enforce SameSite=Strict cookie policies for session cookies, verify that ChurchCRM enforces anti-CSRF token validation on all delete endpoints, and require explicit user confirmation dialogs before executing any delete operations. Within 30 days, monitor the ChurchCRM project for version 7.3.2 or later patch availability and plan an upgrade; meanwhile, restrict delete function access to essential administrative personnel only and implement endpoint-level rate limiting on delete operations to detect mass deletion attacks.

ChurchCRM CVE-2026-44548

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-12 GitHub_M

PHP CSRF Churchcrm Crm

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

vuln.today AI

7.1 HIGH

Network CSRF with no attacker auth (PR:N) but requires a logged-in victim's navigation (UI:R); high integrity from silent record deletion, only partial availability (A:L) per SSVC, no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:05 vuln.today

CVE Published

May 12, 2026 - 22:33 nvd

HIGH 8.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.

AnalysisAI

Cross-site request forgery in ChurchCRM before 7.3.2 lets an attacker-controlled web page trigger top-level GET navigation to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, causing an authenticated victim with the relevant role to silently delete fundraiser, property-type, and note records - including cascaded property and record-to-property assignments. Any privileged user who merely visits a malicious page while logged in can have data destroyed without confirmation. Publicly available exploit code exists (SSVC: poc), but there is no public exploit identified in CISA KEV and EPSS is only 0.01%, indicating no observed widespread exploitation.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management platform (CPE cpe:2.3:a:churchcrm:crm). The root cause is CWE-352 (Cross-Site Request Forgery): the three delete endpoints perform state-changing destructive operations in response to simple GET requests without validating an anti-CSRF token, Origin/Referer, or requiring a same-site POST. Because browsers automatically attach the victim's session cookie to top-level cross-site navigations, an external page can force the victim's authenticated browser to invoke these delete actions. The deletes cascade to related property and record-to-property assignment tables, amplifying the blast radius beyond the single targeted record type.

RemediationAI

Vendor-released patch: upgrade to ChurchCRM 7.3.2 or later, which fixes the CSRF on the affected delete endpoints; see the advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-jx5r-p82p-2p8m. If immediate upgrade is not possible, apply compensating controls: place the application behind access controls so only trusted networks/VPN can reach it (reduces attacker reachability); instruct privileged users to fully log out of ChurchCRM when not actively using it and avoid browsing untrusted sites in the same session (breaks the ambient-authority requirement); and, at a reverse proxy/WAF, block or challenge cross-site GET requests to *Delete.php by enforcing same-origin Referer/Origin on those paths - with the trade-off that legitimate deep links or unusual navigation flows to those endpoints may be blocked. Deploying SameSite=Lax/Strict session cookies (if not already) also mitigates top-level cross-site GET-driven CSRF for most modern browsers.