ChurchCRM versions before 7.1.0 contain an authorization bypass vulnerability (CWE-639, CWE-863) where authenticated users can manipulate the {familyId} parameter in API endpoints such as /family/{familyId}/verify and related paths to perform actions on arbitrary family records without proper role-based access control. This flaw enables unauthorized modification of family states, including deactivation/reactivation, spamming verification emails, and triggering geocoding. The vulnerability has a CVSS 3.1 score of 8.1 (high severity) and is resolved in ChurchCRM 7.1.0.

An authenticated user lacking the EditRecords privilege can perform unauthorized modifications on any family record by exploiting the lack of role-based access control on specific API endpoints. This can lead to integrity issues such as unauthorized state changes, spamming of verification emails, and potentially disruption of family data management. There is no indication of confidentiality or availability impact beyond the stated integrity and availability effects.

Upgrade ChurchCRM to version 7.1.0 or later, where this authorization bypass vulnerability is fixed. Since no official patch link or vendor advisory is provided, verify the upgrade path through the ChurchCRM project repository or official release notes. Until upgraded, restrict API access to trusted users and monitor for suspicious activity related to family record modifications.