ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.
The middleware responsible for authenticating API requests checks for the presence of the string 'api/public' in the request URL. An attacker can place this string anywhere in the URL — even in a request directed to protected endpoints — which causes the middleware to incorrectly treat the request as public and skip user identity verification. The vulnerability requires no privileges, user interaction, or special network conditions (network vector, low attack complexity).
An attacker gains unauthorized access to all protected API endpoints, leading to complete disclosure of personal and contact information of church members as well as system configuration information. Unauthorized data modification is also possible (high impact on integrity).
ChurchCRM should be updated to version 7.1.0 or later, in which the vulnerability has been fixed. Details are available in the vendor's references (GitHub Security Advisory GHSA-v3p2-mx78-pxhc).
ChurchCRM in all versions prior to 7.1.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NChurchcrm
APPChurchcrm< 7.1.0
Related vulnerabilities
SQL Injection w ChurchCRM przez parametr searchwhat (QueryView.php)
ChurchCRM: pre-auth RCE przez wstrzyknięcie kodu PHP w kreatorze instalacji
ChurchCRM: Path Traversal i RCE przez funkcję przywracania kopii zapasowej
ChurchCRM: ujawnienie danych logowania do bazy danych w komunikacie błędu
Stored XSS w ChurchCRM — przejęcie konta przez nazwy ról grup