ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.
The security patch for CVE-2026-4058 was originally included in the code, but was then silently removed from the file src/api/routes/public/public-user.php by an unrelated pull request — before the tagging of version 7.2.x. As a result, all released versions from the 7.2.x branch were published without actual protection. The vulnerability qualifies as CWE-287 (improper authentication) and CWE-304 (missing critical step in authentication process). An attacker can exploit publicly published PoC code from the original CVE-2026-4058 report.
An attacker with network access and minimal privilege level can bypass the authentication mechanism, gaining unauthorized access to system resources with high impact on data confidentiality and integrity.
ChurchCRM should be updated to version 7.3.1, in which the vulnerability has been fixed. Versions from the 7.2.x branch (7.2.0–7.2.2) are entirely vulnerable and should not be used.
ChurchCRM in versions 7.2.0, 7.2.1, and 7.2.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N