CVE-2026-42289 Details
Description
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.
A cross-site request forgery (CSRF) vulnerability has been identified in ChurchCRM versions prior to 7.3.2. The issue arises in UserEditor.php, where user account creation and permission updates are processed solely through $_POST parameters, lacking any CSRF token validation. This flaw enables an unauthenticated attacker to craft a malicious HTML page that, when accessed by an authenticated administrator, discreetly elevates the privileges of low-privilege users to full administrators or creates a new admin backdoor account, all without the victim's awareness.
Users are advised to update to ChurchCRM version 7.3.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3xq9-c86x-cwpp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3xq9-c86x-cwpp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChurchCRM | < 7.3.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |