PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39341 ChurchCRM CVE debrief

ChurchCRM, an open-source church management system, is vulnerable to time-based SQL injection in versions prior to 7.1.0. The vulnerability exists due to improper input validation in the Reports/ConfirmReportEmail.php endpoint, specifically with the familyId parameter. This allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or manipulation. The vulnerability is patched in version 7.1.0. System administrators and security teams should prioritize patching to mitigate this high-severity vulnerability.

Vendor
ChurchCRM
Product
CRM
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

System administrators and security teams responsible for ChurchCRM installations should prioritize patching to version 7.1.0 or later. This vulnerability, with a CVSS score of 8.1, poses a significant risk due to its high severity and potential for exploitation. Additional attention is required from operators, platform administrators, and vulnerability management teams to ensure proper mitigation and monitoring.

Technical summary

The vulnerability is caused by insufficient sanitization of user input in the familyId parameter of the Reports/ConfirmReportEmail.php endpoint. This allows for time-based SQL injection attacks, which can be used to extract or modify sensitive data within the database. The CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating a high severity. Additional review of the codebase and testing is necessary to fully understand the scope of this vulnerability.

Defensive priority

High

Recommended defensive actions

  • Upgrade ChurchCRM to version 7.1.0 or later
  • Review and sanitize user input for SQL queries
  • Implement additional monitoring for suspicious database activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-07T18:16:46.150Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus. Further verification is recommended to confirm the accuracy of this data.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T18:16:46.150Z and has not been modified since then. The NVD entry is currently Analyzed.