CVE-2026-39341 is a time-based SQL injection vulnerability in ChurchCRM's Reports/ConfirmReportEmail.php endpoint affecting versions before 7.1.0. The vulnerability occurs due to improper input validation and failure to use sanitized input in SQL query construction, classified under CWE-89. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting confidentiality and integrity but not availability. The vulnerability is resolved in ChurchCRM version 7.1.0.

Successful exploitation allows an attacker with low privileges to execute arbitrary SQL commands via the familyId parameter, potentially leading to unauthorized disclosure and modification of sensitive data within the ChurchCRM database. There is no reported impact on system availability. No known exploits are reported in the wild at this time.

Upgrade ChurchCRM to version 7.1.0 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 7.1.0, applying this official fix is the recommended remediation. Patch status is not explicitly confirmed beyond this version update, so verify with the vendor advisory or official release notes for the latest guidance.