CVE-2025-67876

An attacker with the 'Manage Groups' permission creates or edits a role name in a group by injecting malicious JavaScript code into its field. The payload is saved in the database and then rendered without proper sanitization on pages such as GroupView.php or PersonView.php. Any user who views this page unknowingly executes the malicious script in their own browser. In this way, the attacker can hijack the victim's session, including the system administrator's session.

An attacker can perform complete session hijacking and take over the account of any user who views the infected page, including administrator accounts. It is also possible to perform actions in the context of the victim, steal credentials and data stored in the system.

At the time of vulnerability publication, there are no patched versions available. You should monitor the vendor's repository at https://github.com/ChurchCRM/CRM and apply the patch immediately after it is released. As a temporary measure, it is recommended to revoke low-privilege users' ability to manage groups ('Manage Groups') and strictly verify and limit the number of people who have this permission.

ChurchCRM version 6.4.0 and earlier