CVE-2026-40581
CSRF Vulnerability in ChurchCRM Allows Unauthorized Family Data Deletion
Publication date: 2026-04-18
Last updated on: 2026-04-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| churchcrm | churchcrm | to 7.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in ChurchCRM versions prior to 7.2.0. The family record deletion endpoint (SelectDelete.php) allows permanent and irreversible deletion of family records and all associated data through a simple GET request that lacks CSRF token validation.
An attacker can create a malicious webpage that, when visited by an authenticated administrator, silently triggers the deletion of targeted family records including notes, pledges, persons, and property data without any user interaction.
This means that an attacker can cause data loss by exploiting the lack of proper request validation.
How can this vulnerability impact me? :
The vulnerability can lead to permanent and irreversible deletion of critical family records and all associated data in ChurchCRM.
- Loss of important data such as notes, pledges, persons, and property information.
- Data deletion can be triggered silently without the administrator's knowledge or consent.
- Potential disruption of church management operations due to missing data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade ChurchCRM to version 7.2.0 or later, where the issue has been fixed.
Until the upgrade can be performed, restrict access to the family record deletion endpoint (SelectDelete.php) to trusted administrators only and avoid visiting untrusted or suspicious pages while authenticated as an administrator.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to permanently and irreversibly delete family records and all associated data without proper authorization or user interaction. This could lead to loss of critical personal data managed by the system.
Such unauthorized data deletion may impact compliance with data protection regulations like GDPR and HIPAA, which require proper safeguards to protect personal data integrity and availability.
Specifically, the lack of CSRF token validation and the use of a plain GET request to perform deletions could be seen as insufficient security controls, potentially violating principles of data protection and accountability.