What is CVE-2026-44547?

CVE-2026-44547 is a critical-severity vulnerability in Churchcrm Crm, classified under Improper Authentication. CVSS score: 9.6/10. Published 2026-05-12.

How severe is CVE-2026-44547?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Auth bypass in Churchcrm Crm

CVE-2026-44547

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.

Vulnerability class: Broken Authentication

EPSS: 0.002 (11.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.

Affected products

Churchcrm Crm — versions >= 7.2.0, < 7.3.1

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-44547?: CVE-2026-44547 is a critical-severity vulnerability in Churchcrm Crm, classified under Improper Authentication. CVSS score: 9.6/10. Published 2026-05-12.
How severe is CVE-2026-44547?: Critical severity. CVSS v3 base score is 9.6 out of 10.