Vulnerability in Churchcrm Crm

CVE-2026-40582

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user's API key, bypassing the normal authentication flow th…

EPSS: 0.000 (12.6th percentile) — read the EPSS interpretation.

Affected products

Churchcrm Crm — versions < 7.2.0

Weakness classification (CWE)

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8cwr-x83m-mh9x (x_refsource_CONFIRM)
https://github.com/ChurchCRM/CRM/pull/8607 (x_refsource_MISC)
https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850 (x_refsource_MISC)