A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.5 · churchcrmNVD modified 2026-10-19 16:10
Affected (CPE criteria) 1
cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*
References 7
- https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 Patch
- https://github.com/ChurchCRM/CRM/pull/7376 Issue Tracking
- https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.327667 Permissions Required, VDB Entry
- https://vuldb.com/?id.327667 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.669916 Third Party Advisory, VDB Entry
- https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md Exploit, Third Party Advisory