External risk intelligence

ChurchCRM Authentication Bypass Exposes Member Data.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-39339

ChurchCRM is a web-based management application designed to handle member data and operations. Such systems are commonly deployed as web-facing applications to allow authorized users to access data remotely, making the API middleware, which handles authentication and request routing, a service that is frequently reachable via the public internet.

Authentication Bypass

Churchcrm

before 7.1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in ChurchCRM, an open-source church management system, allows unauthenticated attackers to bypass authentication and access sensitive church member and system data by manipulating the request URL. This issue impacts versions prior to 7.1.0 and could lead to a complete exposure of confidential information.

Unauthenticated API access to church data.
Affects systems managing member and operational information.
Confirm relevance and ensure systems are updated.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication to access sensitive church member data and system information by sending a request to the ChurchCRM API with "api/public" included in the URL. This occurs because the API middleware incorrectly handles authentication, allowing unauthenticated access to all protected endpoints.

No authentication required for entry.
Requests containing "api/public" trigger bypass.
Risk of complete data exposure.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could access all protected API endpoints by including "api/public" anywhere in the request URL, potentially exposing sensitive church member data and system information.

Church member and system data.
Unauthenticated API access.
Complete data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, the Platform or Application Engineering team responsible for ChurchCRM deployments would likely lead the response, with support from Security Operations for exposure analysis and Vendor Management if a third-party hosted solution is in place. The immediate first step involves identifying all ChurchCRM instances, verifying their external reachability and criticality to business operations, and locating the specific system owner. Following this, a risk-based remediation plan, coordinated with the identified owner, should be developed.

Own by Platform/Application Engineering.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ChurchCRM?

ChurchCRM is an open-source software platform used by religious organizations to manage their administrative operations. It serves as a centralized hub for storing sensitive church member profiles, financial records, and operational data, typically running as a web-based application to allow staff to access information and manage tasks remotely.

What does CVE-2026-39339 mean?

This is an authentication bypass vulnerability, classified as Improper Access Control (CWE-284). It means the software's security checks, which are designed to ensure only authorized users can view sensitive data, fail to trigger correctly. Because of this flaw in the API middleware, the system treats unauthenticated requests as if they were valid, granting full access to protected endpoints.

How is the authentication bypass triggered?

An attacker triggers this flaw by manipulating the request URL sent to the application. Specifically, including the string "api/public" anywhere in the URL causes the middleware to incorrectly bypass authentication requirements. Requests that do not contain this specific string or use standard, authorized login procedures are not subject to this specific bypass path.

Is my ChurchCRM instance at high risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your ChurchCRM instance is web-facing. Because these systems are frequently deployed on the public internet to enable remote access, the API middleware affected by this bug is often directly reachable by external actors, significantly increasing the likelihood of unauthorized data exposure.

How do I fix this security issue?

The primary response is to update your software to version 7.1.0 or later, as this version contains the patch that corrects how the API middleware handles authentication. Before updating, identify all instances of ChurchCRM within your environment, confirm their version numbers, and ensure that patching does not disrupt your specific operational workflows.

References

github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.