CVE-2026-44547
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- EPSS probability
- 0.21%
- CWE
- CWE-287, CWE-304
- Published
- 2026-05-12
- Last modified
- 2026-05-13
Affected products
- ChurchCRM CRM
Weakness type
Related vulnerabilities
- CVE-2026-87924 — Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
- CVE-2026-87922 — Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication
- CVE-2026-87016 — Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-87806 — Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
- CVE-2026-79974 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-80099 — Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
- CVE-2026-76009 — Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint