CVE-2026-40582: ChurchCRM Authentication Bypass via Alternate Login Endpoint

Overview

ChurchCRM is an open-source church management system. According to the GitHub Security Advisory-based record, its public user login API endpoint returns the user's API key after validating only the username and password. This path does not enforce the account lockout and two-factor authentication checks that the normal login flow applies. The weakness is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel. The fix is available in version 7.2.0 according to the record.

Impact

The record states that an attacker who knows a user's password could obtain API access even when the account is locked or has two-factor authentication enabled. The API key would grant access to protected API endpoints with that user's privileges. The CVSS 4.0 base score in the record is 9.1 (critical), with a vector indicating network attack, low complexity, no privileges or user interaction required, and high confidentiality and integrity impact on the vulnerable system.

Affected products and versions

• Product: ChurchCRM (open-source church management system).
• Affected: versions prior to 7.2.0, as stated in the record description.
• Fixed: version 7.2.0, as stated in the record description.
• The structured affected and fixes fields in the record are empty, so the version range relies on the narrative description.

Exploitation status

The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00682 (percentile 0.51229), which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

• Upgrade ChurchCRM to version 7.2.0 or later, which the record identifies as the fixed release.
• Review the referenced GitHub advisory and the fixing commit to confirm the change in your deployment context.
• Until patched, consider restricting access to the public API login endpoint at the network or reverse proxy layer, where your environment allows it.
• Rotate API keys for accounts that may have been used against the login endpoint, particularly accounts with lockout or two-factor events, after applying the update.

Detection guidance

• Review web server and application logs for unusual volumes of requests to the public user login API path.
• Look for successful API key retrievals for accounts that were locked out or had two-factor authentication enabled.
• Monitor for API activity from unfamiliar sources that follows a login request to the public endpoint.

Limitations of the available information

The record does not provide structured affected version ranges, a patch-specific changelog, or exploit availability details. The duplicate advisory GHSA-472m-p3gf-46xp is mentioned but its content was not provided. The CVSS 4.0 vector includes many environmental and threat metrics set to not defined, so the base score is the only scored value available. The record's published date and EPSS date are as given and were not independently verified.

Frequently asked questions

What is the fixed version for CVE-2026-40582?

According to the record, ChurchCRM version 7.2.0 fixes this issue. Versions prior to 7.2.0 are described as affected.

Is this vulnerability known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Upgrade to ChurchCRM 7.2.0 or later, review the referenced advisory, and rotate API keys for accounts that may have been targeted at the login endpoint.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.