CVE-2026-58410 is an authorization bypass vulnerability in ChurchCRM's family-scoped endpoints affecting versions before 7.4.0. The backend fails to verify that the requested familyId belongs to the authenticated user, allowing low-privileged users with EditSelf access to read and modify other families' records. Additionally, users with Notes permission could create notes on other families' records. This breaks the intended access control scope and exposes sensitive congregation data. The vulnerability has been addressed in ChurchCRM version 7.4.0.

An authenticated non-admin user with EditSelf access can access and modify records of other families, violating data confidentiality and integrity. If the user also has Notes permission, they can add notes to unrelated family records. This leads to unauthorized disclosure and partial modification of sensitive congregation information. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade ChurchCRM to version 7.4.0 or later, where this authorization flaw has been fixed. Since this is an on-premises product, administrators must apply the official update to remediate the vulnerability. Patch status is not explicitly stated but the vendor fixed the issue in 7.4.0, so updating to that version or newer is required.