CVE-2026-39339 - Vulnerability Analysis
CriticalCVSS: 9.1Last Updated: April 7, 2026
ChurchCRM - Authentication Bypass
Published: April 7, 2026Updated: April 7, 2026Remote Exploitable
Overview
ChurchCRM < 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public'.
Severity & Score
Severity: Critical
CVSS Score: 9.1
Impact
Unauthenticated attackers can access all protected API endpoints, exposing sensitive church member data and system information.
Mitigation
Update to version 7.1.0 or later.
Related Resources
Details
- CVE ID
- CVE-2026-39339
- Severity
- Critical
- CVSS Score
- 9.1
- Type
- broken_authentication
- Status
- new
CWE
- CWE-284
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N