CVE-2026-58408: ChurchCRM CRM, заобикаляне на вход и права

Описание

Оригинално описание

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

Засегнати продукти

• ChurchCRM CRM: < 7.4.0

Вид слабост

• CWE-862 Missing Authorization
• CWE-863 Incorrect Authorization

История

Други уязвимости в ChurchCRM CRM

• 7.0CVE-2026-58411
• 7.1CVE-2026-58410
• 9.1CVE-2026-58409
• 8.1CVE-2026-44548
• 9.6CVE-2026-44547

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-58408
• https://nvd.nist.gov/vuln/detail/CVE-2026-58408
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63