CVE-2026-42289 is an improper privilege management vulnerability in ChurchCRM CRM versions before 7.3.2. The UserEditor.php script processes user creation and permission changes solely through $_POST parameters without implementing CSRF token validation. This lack of CSRF protection enables an attacker to perform a cross-site request forgery attack that escalates privileges or creates unauthorized administrator accounts when an authenticated admin visits a malicious page. The vulnerability is addressed in ChurchCRM version 7.3.2.

Successful exploitation allows an unauthenticated attacker to escalate privileges of any low-privilege user to full administrator or create a new administrator account without the victim administrator's knowledge. This results in full compromise of the affected ChurchCRM instance, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.8.

Upgrade ChurchCRM to version 7.3.2 or later, where this vulnerability has been fixed by adding proper CSRF token validation to user account and permission management functions. Until the upgrade is applied, restrict access to the UserEditor.php functionality to trusted administrators and avoid visiting untrusted web pages while authenticated to the CRM.