Auth bypass in Churchcrm Crm
CVE-2026-58410
ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged users to read and modify other families’ records. An authenticated non-admin user with EditSelf access can supply another family’s `familyId` and access records outside their own family scope. The backend trusts the attacker-controlled `familyId` and loads the corresponding family entity by ID without verifying that the requested family belongs to the current user. If the same user also has Notes permission, they can create notes on another family’s record. This breaks the intended EditSelf scope and allows access to unrelated congregation records. This issue has been fixed in version 7.4.0.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (20.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 20.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Churchcrm Crm — versions < 7.4.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-58410?
- CVE-2026-58410 is a high-severity vulnerability in Churchcrm Crm, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.1/10. Published 2026-07-13.
- How severe is CVE-2026-58410?
- High severity. CVSS v3 base score is 7.1 out of 10.