CVE-2026-35572 is a server-side request forgery (SSRF) vulnerability in ChurchCRM, an open-source church management system. Versions before 6.5.3 allow an attacker to trigger outbound HTTP/HTTPS requests by injecting a malicious URL into the Referer request header. This causes the server to connect to attacker-controlled domains, confirmed through out-of-band application security testing (OAST). The vulnerability is fixed in ChurchCRM version 6.5.3. The CVSS 4.0 base score is 7.0, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Successful exploitation allows an attacker to make the vulnerable server initiate HTTP/HTTPS requests to arbitrary external hosts. This can lead to information disclosure or interaction with internal network resources depending on the server environment. The vulnerability affects confidentiality and potentially availability, but does not require user interaction or privileges beyond high-level privileges on the server.

Upgrade ChurchCRM to version 6.5.3 or later, where this SSRF vulnerability is fixed. Since this is an open-source product and not a cloud service, patching the software is the primary remediation. Patch status is not explicitly stated beyond the fix in version 6.5.3, so users should verify they have applied this update.