CVE-2026-58408
ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII
Description
ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.
INFO
Published Date :
July 13, 2026, 8:16 p.m.
Last Modified :
Oct. 24, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Upgrade ChurchCRM to version 7.4.0 or later.
- Verify export functionality is restricted to authorized users.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-58408.
| URL | Resource |
|---|---|
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-58408 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-58408
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-58408 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-58408 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: CRM de ChurchCRM, Description: ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 7.4.0, un usuario con pocos privilegios puede eludir la interfaz de usuario /admin/export y exfiltrar todo el directorio de miembros. El endpoint POST /CSVCreateFile.php genera y transmite un CSV que contiene la Información de Identificación Personal (PII) completa de cada registro de Persona/Familia en la base de datos, sin realizar ninguna comprobación de autorización a nivel de característica o a nivel de objeto más allá de la puerta de enlace general ’tiene algún permiso de administrador’ heredada del bootstrap de la página heredada. En otras palabras, cualquier bandera de permiso no-administrador es suficiente para alcanzar el endpoint de exportación masiva de CSV, a pesar de que dichos usuarios no deberían tener derechos de exportación de datos. El script de exportación carece de una comprobación de autorización dedicada isAdmin() (o una nueva bExportData) propia. Este problema ha sido solucionado en la versión 7.4.0. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 14, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-58408', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-14T12:57:23.509918Z'} -
New CVE Received by [email protected]
Jul. 13, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'ChurchCRM', 'product': 'CRM', 'versions': [{'status': 'affected', 'version': '< 7.4.0'}]}] Added Description ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-862 Added CWE CWE-863 Added Reference https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63