Authorization Bypass in ChurchCRM Family Records

Executive Summary

CVE-2026-58410 is an authorization flaw in ChurchCRM, an open-source church management system. Before version 7.4.0, the system had a vulnerability in its family-scoped endpoints that allowed low-privileged users to access and modify records belonging to other families.

An authenticated non-admin user with EditSelf access could supply another family’s familyId in requests. The backend would then trust this attacker-controlled familyId and load the corresponding family’s records without verifying whether the requested family belonged to the current user. This allowed the user to read or modify records outside their intended scope.

Additionally, if the same user had Notes permission, they could create notes on another family’s record. This vulnerability effectively broke the intended EditSelf scope, enabling unauthorized access to unrelated congregation records.

The issue was fixed in version 7.4.0 of ChurchCRM.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to family records in ChurchCRM by low-privileged users. Since the vulnerability involves an authenticated non-admin user with EditSelf access manipulating the familyId parameter, you can perform the following steps:

• Review ChurchCRM logs for unusual access patterns, such as a user repeatedly accessing or modifying records with different familyId values that do not belong to them.
• Check the database or audit logs for notes or modifications made by users with EditSelf permissions on records outside their assigned family scope.
• Use a web application security scanner or manual testing to attempt accessing family records with manipulated familyId values while logged in as a low-privileged user. For example, intercept requests to endpoints like /FamilyEditor.php or similar and modify the familyId parameter to test for unauthorized access.

There are no specific commands provided for detection, as this is a logical access control flaw rather than a technical vulnerability that can be scanned for with standard tools. Manual verification or custom scripting may be required.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of ChurchCRM (prior to 7.4.0), this vulnerability could impact you in the following ways:

• Unauthorized access to sensitive family records: Low-privileged users could view or modify records of other families, including personal or confidential information.
• Data integrity risks: Malicious or careless users could alter records they should not have access to, leading to incorrect or misleading information in the system.
• Privacy violations: If notes or other sensitive data are added to another family’s record, it could expose private details to unauthorized users.
• Compliance risks: Unauthorized access to or modification of records could violate internal policies or external regulations, depending on the nature of the data stored.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could have significant implications for compliance with standards and regulations, depending on the type of data stored in ChurchCRM:

• GDPR (General Data Protection Regulation): If ChurchCRM processes personal data of EU citizens, this vulnerability could lead to unauthorized access or disclosure of personal data, violating GDPR’s principles of data protection and confidentiality. Organizations could face fines or legal action if they fail to protect personal data adequately.
• HIPAA (Health Insurance Portability and Accountability Act): If ChurchCRM is used to store or manage protected health information (PHI) in a healthcare-related context, this vulnerability could result in unauthorized access to PHI. This would be a violation of HIPAA’s Privacy Rule, which requires strict controls over who can access health information.
• Other regulations: Depending on the jurisdiction and the nature of the data, this vulnerability could also impact compliance with other standards, such as the California Consumer Privacy Act (CCPA) or sector-specific regulations that require safeguarding sensitive information.

Organizations using affected versions of ChurchCRM should update to version 7.4.0 or later to mitigate these compliance risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade ChurchCRM to version 7.4.0 or later, as the issue has been fixed in this release. This is the most effective way to resolve the vulnerability.
• If upgrading is not immediately possible, restrict permissions for non-admin users with EditSelf access. Temporarily revoke Notes permissions for these users to prevent unauthorized note creation on other families' records.
• Monitor and audit user activity, particularly for users with EditSelf permissions, to detect any unauthorized access or modifications to family records.
• Implement additional server-side validation to ensure that users can only access records within their assigned family scope. This may require custom code changes until the official patch is applied.

Useful 0 Not Useful 0