CVE-2026-35572 Details
Description
ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS requests to arbitrary hosts (SSRF) by supplying a crafted URL in the Referer request header. The server subsequently makes an outbound request to the attacker-controlled domain, confirmed via OAST. This vulnerability is fixed in 6.5.3.
A server-side request forgery (SSRF) vulnerability has been identified in ChurchCRM versions prior to 6.5.3. This issue allows attackers to send crafted URLs in the Referer header, which the server then uses to make outbound HTTP or HTTPS requests to arbitrary domains. The vulnerability was confirmed through Out-of-Band Application Security Testing (OAST).
If arbitrary external requests are not intended, implement an allow-list for permitted schemes, hosts, and ports for server-side fetches. Enforce scheme restrictions to allow only HTTPS, canonicalize URLs, and block IP literals, private or loopback hostnames, and non-standard ports. Use DNS pinning or resolve-then-connect with checks to prevent DNS rebinding, and avoid fetching untrusted URLs from request headers. If some external interactions are necessary, restrict egress from the application network to required destinations only, block access to internal address ranges, and harden the server to protect services bound to loopback.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-44x3-28jv-mrwq | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-44x3-28jv-mrwq | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| churchcrm churchcrm | < 6.5.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |