The vulnerability in ChurchCRM CRM (CVE-2026-40581) is a CSRF issue affecting versions before 7.2.0. The family record deletion endpoint accepts a plain GET request to irreversibly delete family records and related data without validating a CSRF token. This allows an attacker to craft a malicious webpage that, when visited by an authenticated admin user, causes silent deletion of targeted data including notes, pledges, persons, and property data. The vulnerability is classified under CWE-352 (CSRF) and CWE-862 (missing authorization). It has a CVSS 3.1 score of 8.1 (high severity). The vulnerability was fixed in ChurchCRM version 7.2.0.

Successful exploitation results in permanent, irreversible deletion of family records and all associated data in ChurchCRM, impacting data integrity and availability. The attack requires an authenticated administrator to visit a malicious page, which then triggers the deletion without user interaction. There is no confidentiality impact reported. This can cause significant data loss for organizations using affected versions.

Upgrade ChurchCRM to version 7.2.0 or later, where this CSRF vulnerability has been fixed. Until upgrading, restrict access to the deletion endpoint and avoid visiting untrusted web pages while authenticated as an administrator. Patch status is not explicitly stated but the vendor fixed the issue in version 7.2.0, so applying this official fix is the recommended remediation.