Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-39339ChurchCRM has an API Authentication Bypass

Critical 9.1

In plain English

A critical-severity improper access control in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.4%top 28.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.

Affected products (as reported)

Vendor	Product	Versions
ChurchCRM	CRM	< 7.1.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc x_refsource_CONFIRM