CVE-2026-39331 - Vulnerability Analysis

Overview

ChurchCRM < 7.1.0 contains a broken access control vulnerability caused by lack of role-based access control on family record modification endpoints, letting authenticated API users modify any family record state without proper authorization, exploit requires authenticated API user.

Severity & Score

Impact

Authenticated users can modify any family record state, potentially leading to unauthorized data changes and misuse of system functions.

Mitigation

Update to version 7.1.0 or later.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner