CSV Data Export Flaw in ChurchCRM

Executive Summary

CVE-2026-58408 is a Broken Access Control vulnerability in ChurchCRM, an open-source church management system. It affects versions prior to 7.4.0.

The vulnerability allows a low-privileged user to bypass the intended /admin/export user interface and exfiltrate the entire member directory. This happens because the POST /CSVCreateFile.php endpoint generates and streams a CSV file containing the full Personally Identifiable Information (PII) of every person and family record in the database.

The endpoint does not perform proper feature-level or object-level authorization checks beyond a coarse 'has any admin permission' gate inherited from the legacy page bootstrap. This means any user with even a single non-admin permission flag can access the bulk-export endpoint, even if they should not have data export rights.

The export script is missing a dedicated isAdmin() or similar authorization check, allowing unauthorized users to directly exfiltrate sensitive data via a single POST request.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check if your ChurchCRM instance is running a vulnerable version (7.1.0 through 7.3.3).

• Verify the installed version of ChurchCRM by logging into the admin dashboard or checking the version in the application's configuration files.
• Test for unauthorized access to the vulnerable endpoint by sending a POST request to /CSVCreateFile.php. If a low-privileged user can successfully retrieve a CSV file containing PII, the system is vulnerable.

Example command to test the endpoint (replace <target> with the ChurchCRM URL and <session_cookie> with a valid low-privileged user session):

• curl -X POST -H "Cookie: PHPSESSID=<session_cookie>" https://<target>/CSVCreateFile.php

If the response contains a CSV file with sensitive data, the vulnerability is confirmed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of ChurchCRM (7.1.0 through 7.3.3).

• Unauthorized access to sensitive data: A low-privileged user can export the entire member directory, including full names, addresses, phone numbers, emails, dates of birth, and other PII without proper authorization.
• Privacy violations: The exposure of PII can lead to privacy breaches, putting members' personal information at risk.
• Reputational damage: If sensitive data is leaked, it can harm the reputation of the organization using ChurchCRM.
• Legal and compliance risks: Unauthorized access to PII can result in violations of data protection laws, leading to potential legal consequences.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with several common data protection standards and regulations.

• GDPR (General Data Protection Regulation): The unauthorized access and exfiltration of PII can violate GDPR principles, particularly those related to data protection, confidentiality, and the rights of individuals. Organizations may face fines or legal action if they fail to protect personal data adequately.
• HIPAA (Health Insurance Portability and Accountability Act): If the exposed PII includes health-related information, this vulnerability could lead to HIPAA violations, as the regulation mandates strict controls over protected health information (PHI).
• CCPA (California Consumer Privacy Act): The exposure of personal data without proper authorization can violate CCPA requirements, which grant consumers rights over their personal information and impose obligations on businesses to protect it.
• LGPD (Lei Geral de Proteção de Dados): Similar to GDPR, Brazil's LGPD requires organizations to protect personal data. Unauthorized access to PII can result in non-compliance with LGPD, leading to penalties.

Overall, this vulnerability poses significant compliance risks, as it enables unauthorized access to sensitive data that is protected under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate steps to mitigate this vulnerability include:

• Upgrade ChurchCRM to version 7.4.0 or later, as the issue has been fixed in this release.
• If upgrading is not immediately possible, restrict access to the /CSVCreateFile.php and /CSVExport.php endpoints by modifying the server configuration (e.g., Apache or Nginx) to block access to these paths for non-admin users.
• Review and audit user permissions to ensure only authorized administrators have access to data export functionalities.
• Monitor network traffic for unusual POST requests to /CSVCreateFile.php, which may indicate exploitation attempts.
• Consider implementing additional authorization checks at the application level for sensitive endpoints until the patch is applied.

Useful 0 Not Useful 0