Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2026-40485ChurchCRM: Username Enumeration via Differential Response in Public Login API

Medium 5.3

In plain English

A medium-severity security flaw in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.

Affected products (as reported)

Vendor	Product	Versions
ChurchCRM	CRM	< 7.2.0

Weakness: CWE-307, CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx x_refsource_CONFIRM
https://github.com/ChurchCRM/CRM/pull/8607 x_refsource_MISC
https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850 x_refsource_MISC