CVE Intelligence
Analysis AI-assisted

CVE-2026-42288: ChurchCRM Setup Wizard Pre-Auth Code Injection

A pre-authentication code injection flaw in the ChurchCRM setup wizard, tied to unsanitized DB_PASSWORD input, remains exploitable after an incomplete fix for CVE-2026-39337. The CNA scores it critical at CVSS 3.1 10.0, and the record states it is fixed in version 7.3.2. No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

ChurchCRM is an open-source church management system. According to the GitHub Security Advisory, the fix for CVE-2026-39337 was incomplete, and a pre-authentication code injection issue in the setup wizard, linked to unsanitized DB_PASSWORD input, remained exploitable. The weakness is classified as CWE-94 (Code Injection).

Impact

  • The advisory describes a pre-authentication remote code execution vulnerability.
  • The CNA-assigned CVSS 3.1 base score is 10.0 (critical), with high confidentiality, integrity and availability impact and a changed scope.
  • Inference: an attacker with network access to an exposed setup wizard could potentially gain control of the underlying server, so exposure of the setup wizard is the main risk factor.

Affected products and versions

  • Product: ChurchCRM, an open-source church management system.
  • The description states the product is affected prior to version 7.3.2.
  • The affected and fixes fields in the record are empty, so the full version range beyond the description is unknown.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The recorded EPSS probability is 0.01013 (percentile 0.62261), which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Upgrade ChurchCRM to version 7.3.2 or later, as stated in the advisory.
  • Because the earlier fix was incomplete, verify after upgrading that the setup wizard is no longer reachable on production systems.
  • Restrict network access to the setup wizard and administrative paths, and remove or disable the installer once setup is complete (inference based on general hardening practice).
  • Keep access restrictions at the reverse proxy or firewall in place until the upgrade is verified.

Detection guidance

  • Review web server access logs for unexpected requests to setup or installation paths, especially from unknown sources.
  • Monitor the application host for unusual child processes started by the web server account.
  • Confirm whether the setup wizard was reachable after installation; a completed installation should not expose it.

Limitations of the available information

  • The record contains no affected or fixed version entries; the fixed version comes from the description and the GitHub advisory.
  • The record lists the source status as Deferred, so NVD and CVE Program details may change.
  • The CVE-2026-39337 fix details are not included in the record.
  • This analysis does not include proof-of-concept or technical attack details.

Frequently asked questions

Which ChurchCRM version fixes this issue?

The record states that the vulnerability is fixed in version 7.3.2, and the description says versions prior to 7.3.2 are affected. Upgrade to 7.3.2 or later.

Is this vulnerability being exploited in the wild?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted. The recorded EPSS probability is 0.01013.

Why does the record mention CVE-2026-39337?

The description says the fix for CVE-2026-39337 was incomplete, which is why this separate CVE was assigned for the remaining exploitable issue in the setup wizard.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.