What is the CVSS score of CVE-2026-58408?

CVE-2026-58408 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

ChurchCRM CVE-2026-58408

MEDIUM

Missing Authorization (CWE-862)

2026-07-13 GitHub_M

PHP Authentication Bypass Churchcrm Crm

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L confirmed because any single non-admin permission flag suffices; C:H for full bulk PII export; I:N and A:N as the endpoint only reads and streams data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 20:31 vuln.today

DescriptionCVE.org

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

AnalysisAI

Authorization bypass in ChurchCRM prior to version 7.4.0 exposes the full congregation member directory to any low-privileged authenticated user via the unprotected POST /CSVCreateFile.php endpoint. The endpoint streams a CSV containing complete PII for every Person and Family record in the database without performing a dedicated function-level authorization check, relying instead on a legacy coarse gate that any single non-admin permission flag satisfies. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid low-privilege account - makes this a high-priority remediation for organizations managing sensitive congregation data.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system (CPE: cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-862 (Missing Authorization), a function-level access control failure. The /CSVCreateFile.php bulk-export script inherits only a coarse 'has any admin permission' gate from the legacy page bootstrap, which is satisfied by any user holding at least one non-admin permission flag. The intended security model requires an explicit isAdmin() call or a dedicated bExportData permission check on this specific endpoint, neither of which is implemented in versions prior to 7.4.0. Because the export script generates and streams the full Person and Family record set directly from the database, successful exploitation yields bulk PII exfiltration in a single authenticated HTTP request.

RemediationAI

Upgrade ChurchCRM to version 7.4.0 or later, which introduces a dedicated authorization check on the /CSVCreateFile.php endpoint; vendor patch details are available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63. If immediate patching is not feasible, restrict POST requests to /CSVCreateFile.php at the web server or reverse proxy layer (e.g., nginx deny or Apache mod_rewrite rules) - note this will also block legitimate admin bulk-export use until patched. Alternatively, audit all ChurchCRM accounts to identify those holding any permission flag and temporarily revoke or suspend them until the patch can be applied, accepting the operational trade-off of reduced volunteer access. After patching, review server access logs for historical POST requests to /CSVCreateFile.php from non-admin sessions to assess whether prior exploitation occurred.