CVE-2026-40581 Details
Description
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.
A vulnerability in ChurchCRM's family record deletion process has been identified, affecting versions prior to 7.2.0. The issue arises in the SelectDelete.php file, where the deletion endpoint allows for permanent removal of family records through a standard GET request. This process lacks proper Cross-Site Request Forgery (CSRF) protection, enabling an attacker to create a malicious page that, when accessed by an authenticated administrator, automatically deletes targeted family records along with associated notes, pledges, persons, property data, and photo files. The vulnerability has been patched in version 7.2.0, which removes the GET-based deletion method and replaces it with a more secure API endpoint that includes CSRF protection.
Users can update to ChurchCRM version 7.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674 | [email protected] | Source CodeVendor |
| https://github.com/ChurchCRM/CRM/pull/8613 | [email protected] | Issue TrackingVendor |
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChurchCRM | <= 7.1.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |