The vulnerability in ChurchCRM CRM versions before 7.2.0 involves improper restriction of excessive authentication attempts (CWE-307) and user enumeration (CWE-204) through the public API login endpoint (/api/public/user/login). The endpoint returns different HTTP status codes depending on whether a username exists, enabling attackers to identify valid usernames without authentication. Additionally, the absence of rate limiting or account lockout allows attackers to perform this enumeration without impediment. This vulnerability has been addressed in ChurchCRM version 7.2.0.

An unauthenticated attacker can enumerate valid usernames by analyzing HTTP response codes, potentially aiding further targeted attacks such as credential stuffing or phishing. The vulnerability does not directly disclose passwords or allow unauthorized access but leaks information that reduces the effort required for subsequent attacks. There is no indication of known exploits in the wild.

Upgrade ChurchCRM to version 7.2.0 or later, where this vulnerability is fixed. The fix includes standardizing response codes and implementing controls to restrict excessive authentication attempts. Until upgrading, consider implementing external rate limiting or monitoring to reduce the risk of username enumeration.