What is the CVSS score of CVE-2026-58410?

CVE-2026-58410 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of ChurchCRM are affected by CVE-2026-58410?

ChurchCRM versions before 7.4.0 contain an access control vulnerability allowing authenticated users to view and modify family records outside their assigned congregation.

How to fix or mitigate CVE-2026-58410?

Within 24 hours, audit and restrict EditSelf and Notes permissions to administrative roles only, and review access logs for unauthorized family record access across congregations. Within 7 days, implement enhanced API logging to track family ID parameters and access patterns, disable the Notes feature until patched if operationally feasible, and conduct a data integrity audit to identify any unauthorized modifications. Within 30 days, contact the ChurchCRM vendor for patch availability and timeline, test any released patch in a non-production environment, and plan a controlled production upgrade.

ChurchCRM CVE-2026-58410

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-13 GitHub_M

Authentication Bypass Churchcrm Crm

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Authenticated low-privilege user (PR:L) sends a network request (AV:N/AC:L/UI:N) to read other families' PII (C:H); integrity is limited to gated note creation (I:L) and availability is unaffected (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:02 vuln.today

CVE Published

Jul 13, 2026 - 20:26 cve.org

HIGH 7.1

DescriptionCVE.org

ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged users to read and modify other families’ records. An authenticated non-admin user with EditSelf access can supply another family’s familyId and access records outside their own family scope. The backend trusts the attacker-controlled familyId and loads the corresponding family entity by ID without verifying that the requested family belongs to the current user. If the same user also has Notes permission, they can create notes on another family’s record. This breaks the intended EditSelf scope and allows access to unrelated congregation records. This issue has been fixed in version 7.4.0.

AnalysisAI

Insecure Direct Object Reference in ChurchCRM before 7.4.0 lets an authenticated non-admin user with EditSelf access read and modify other congregations' family records by supplying a different family's familyId to family-scoped endpoints. Because the backend loads the family entity by the attacker-controlled ID without ownership verification, a user who also holds the Notes permission can additionally create notes on unrelated families' records, breaking the intended self-service scope. No public exploit identified at time of analysis, though the flaw is trivially reproducible by manipulating a request parameter.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management platform used to track members, families, donations, and events. The flaw is a classic CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR-BOLA): family-scoped API endpoints accept a familyId supplied by the client and dereference the corresponding family entity directly, trusting that value as the authorization boundary. The application performs a functional permission check (the EditSelf role, plus optionally Notes) but omits an object-level check that the referenced familyId actually belongs to the requesting user, so any valid family identifier - which are sequential integers and easily enumerated - grants access to that record.

RemediationAI

Vendor-released patch: 7.4.0 - upgrade all ChurchCRM instances to 7.4.0 or later, which adds the missing ownership check on family-scoped endpoints, per advisory https://github.com/ChurchCRM/CRM/security/advisories/GHSA-jjcj-h3cm-p7x7. If immediate upgrade is not possible, reduce the attack surface by minimizing accounts that hold EditSelf and especially Notes permissions, review the user role assignments to remove unnecessary self-service access, and monitor application logs for requests where a user references familyId values outside their own family (a spike in enumerated IDs is a strong indicator of abuse); note that tightening these permissions may remove legitimate self-service capabilities for congregation members and is only a stopgap until the patch is applied.