CVE-2026-42289 is an improper privilege management vulnerability in ChurchCRM's UserEditor.php prior to version 7.3.2. The vulnerability arises because user account creation and permission updates rely solely on $_POST parameters without any CSRF token validation, enabling Cross-Site Request Forgery (CWE-352). An attacker can exploit this by tricking an authenticated administrator into visiting a malicious page, resulting in silent privilege escalation or creation of an unauthorized administrator account. This vulnerability is classified under CWE-269 (Improper Privilege Management), CWE-306 (Missing Authentication for Critical Function), and CWE-352 (Cross-Site Request Forgery). The vendor fixed this issue in ChurchCRM version 7.3.2.

Successful exploitation allows an unauthenticated attacker to escalate privileges of any low-privilege user to full administrator or create a new administrator backdoor account without the administrator's knowledge. This leads to full compromise of the affected ChurchCRM instance, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H).

Upgrade ChurchCRM to version 7.3.2 or later, where this vulnerability is fixed. Since the vulnerability is addressed in this official release, applying this update fully mitigates the risk. No additional mitigations are required if the system is updated.