CVE-2026-40582: CWE-288: Authentication Bypass Using an Alternate Path or Channel in ChurchCRM CRM
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user's API key, bypassing the normal authentication flow that enforces account lockout and two-factor authentication checks. An attacker with knowledge of a user's password can obtain API access even when the account is locked or has 2FA enabled, granting direct access to all protected API endpoints with that user's privileges. This issue has been fixed in version 7.2.0. Note: this issue had a duplicate, GHSA-472m-p3gf-46xp, which has been closed.
AI Analysis
Technical Summary
CVE-2026-40582 is an authentication bypass vulnerability in ChurchCRM CRM versions before 7.2.0. The vulnerability exists because the /api/public/user/login endpoint returns the user's API key after validating only username and password, circumventing the normal authentication flow that enforces account lockout and two-factor authentication. This allows an attacker with a valid password to access protected API endpoints with the user's privileges regardless of account lockout or 2FA status. The vulnerability has a CVSS 4.0 score of 9.1 (critical) and was fixed in ChurchCRM version 7.2.0.
Potential Impact
An attacker who knows a user's password can bypass account lockout and two-factor authentication protections to obtain the user's API key. This grants direct access to all protected API endpoints with the same privileges as the compromised user. The vulnerability could lead to unauthorized access and potential data exposure or manipulation within the ChurchCRM system. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade ChurchCRM to version 7.2.0 or later, where this authentication bypass vulnerability has been fixed. Until the upgrade is applied, be aware that accounts with locked status or two-factor authentication enabled can still be compromised if the password is known. Patch status is confirmed fixed in version 7.2.0.
CVE-2026-40582: CWE-288: Authentication Bypass Using an Alternate Path or Channel in ChurchCRM CRM
Description
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user's API key, bypassing the normal authentication flow that enforces account lockout and two-factor authentication checks. An attacker with knowledge of a user's password can obtain API access even when the account is locked or has 2FA enabled, granting direct access to all protected API endpoints with that user's privileges. This issue has been fixed in version 7.2.0. Note: this issue had a duplicate, GHSA-472m-p3gf-46xp, which has been closed.
CVSS v4.0
Score 9.1critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40582 is an authentication bypass vulnerability in ChurchCRM CRM versions before 7.2.0. The vulnerability exists because the /api/public/user/login endpoint returns the user's API key after validating only username and password, circumventing the normal authentication flow that enforces account lockout and two-factor authentication. This allows an attacker with a valid password to access protected API endpoints with the user's privileges regardless of account lockout or 2FA status. The vulnerability has a CVSS 4.0 score of 9.1 (critical) and was fixed in ChurchCRM version 7.2.0.
Potential Impact
An attacker who knows a user's password can bypass account lockout and two-factor authentication protections to obtain the user's API key. This grants direct access to all protected API endpoints with the same privileges as the compromised user. The vulnerability could lead to unauthorized access and potential data exposure or manipulation within the ChurchCRM system. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade ChurchCRM to version 7.2.0 or later, where this authentication bypass vulnerability has been fixed. Until the upgrade is applied, be aware that accounts with locked status or two-factor authentication enabled can still be compromised if the password is known. Patch status is confirmed fixed in version 7.2.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-14T13:24:29.475Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e2c0dabdfbbecc599fc05f
Added to database: 4/17/2026, 11:23:06 PM
Last enriched: 4/25/2026, 2:57:24 AM
Last updated: 6/1/2026, 5:26:54 PM
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.