What is the CVSS score of CVE-2026-58408?

CVE-2026-58408 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

ChurchCRM CVE-2026-58408

MEDIUM

Missing Authorization (CWE-862)

2026-07-13 GitHub_M

PHP Authentication Bypass Crm

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L confirmed because any single non-admin permission flag suffices; C:H for full bulk PII export; I:N and A:N as the endpoint only reads and streams data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 20:31 vuln.today

DescriptionCVE.org

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

AnalysisAI

Authorization bypass in ChurchCRM prior to version 7.4.0 exposes the full congregation member directory to any low-privileged authenticated user via the unprotected POST /CSVCreateFile.php endpoint. The endpoint streams a CSV containing complete PII for every Person and Family record in the database without performing a dedicated function-level authorization check, relying instead on a legacy coarse gate that any single non-admin permission flag satisfies. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain any low-privilege ChurchCRM account

Delivery

Authenticate and capture session cookie

Exploit

Send POST request to /CSVCreateFile.php directly

Execution

Bypass UI-level export restriction

Impact

Receive full PII CSV of all congregation records

Access

Obtain any low-privilege ChurchCRM account

Delivery

Authenticate and capture session cookie

Exploit

Send POST request to /CSVCreateFile.php directly

Execution

Bypass UI-level export restriction

Impact

Receive full PII CSV of all congregation records

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid ChurchCRM account assigned at least one non-admin permission flag - no administrator access is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the risk profile: the attack is network-reachable, requires no complexity, and needs only a low-privilege account, with high confidentiality impact but no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A volunteer or low-level staff member with a ChurchCRM account holding any single permission flag authenticates normally, then sends a crafted POST request directly to /CSVCreateFile.php - bypassing the /admin/export UI that would otherwise restrict access. The server responds by streaming a full CSV of the congregation database including names, addresses, and contact details for every person and family record. …
Remediation	Upgrade ChurchCRM to version 7.4.0 or later, which introduces a dedicated authorization check on the /CSVCreateFile.php endpoint; vendor patch details are available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63. … Detailed patch versions, workarounds, and compensating controls in full report.