The vulnerability in ChurchCRM CRM versions before 7.2.0 involves improper restriction of excessive authentication attempts (CWE-307) and user enumeration (CWE-204) via the public API login endpoint (/api/public/user/login). The endpoint returns different HTTP status codes depending on whether the username exists (404 for non-existent, 401 for incorrect password on existing user), enabling attackers to enumerate valid usernames without any rate limiting or lockout mechanisms. This information disclosure can aid attackers in further attacks. The issue was addressed and fixed in ChurchCRM version 7.2.0.

An unauthenticated attacker can enumerate valid usernames by analyzing HTTP response codes from the login API endpoint. This information disclosure can facilitate targeted attacks such as credential stuffing or phishing. There is no indication of direct compromise or data loss from this vulnerability alone. The CVSS score is 5.3 (medium severity), reflecting limited confidentiality impact and no integrity or availability impact.

Upgrade ChurchCRM to version 7.2.0 or later, where this vulnerability has been fixed. The fix includes uniform HTTP responses for login attempts and implementation of rate limiting or account lockout to prevent username enumeration. No other mitigation is specified or required once the system is updated.