CVE-2026-39940 ChurchCRM CVE debrief

Who should care

Defenders responsible for ChurchCRM deployments should assess exposure and prioritize upgrading to version 7.0.0 or later. This includes IT administrators, security teams, and developers who manage or use the ChurchCRM application. They should verify the version of ChurchCRM in use and take steps to mitigate the vulnerability until an upgrade can be completed. Additionally, defenders should review compensating controls and monitor for potential securitybre

Why it matters

Defenders should care about CVE-2026-39940 because it allows attackers to potentially redirect authenticated users to arbitrary URLs, which could lead to phishing attacks. Verification of ChurchCRM version and exposure is necessary, and upgrading to version 7.0.0 or later is required to fix the vulnerability.

• Potential redirects to arbitrary URLs could lead to phishing attacks
• Verification of ChurchCRM version and exposure is necessary
• Upgrading to version 7.0.0 or later is required to fix the vulnerability

Technical summary

The ChurchCRM application was vulnerable to a redirect attack, allowing attackers to create links that could redirect authenticated users to any URL chosen by the attacker when they clicked the 'Cancel' button on certain pages, such as in the DonatedItemEditor.php file. This vulnerability was caused by inadequate validation of user input, allowing attackers to inject malicious URLs. The fix in version 7.0.0 validates user input and ensures that redirects are only allowed to authorized URLs. Defenders should prioritize verifying and upgrading to ChurchCRM version 7.0.0 or later, and assess exposure in their current deployment contexts.

Defensive priority

Defenders should prioritize verifying and upgrading to ChurchCRM version 7.0.0 or later, and assess exposure in their current deployment contexts.

Recommended defensive actions

• Verify ChurchCRM version and upgrade to 7.0.0 or later if necessary
• Assess exposure in current deployment contexts
• Monitor for potential redirects to arbitrary URLs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the fix in ChurchCRM version 7.0.0. The vulnerability was reported by security researchers and fixed by the ChurchCRM development team. The fix was released in version 7.0.0 of the software. Defenders should verify the version of ChurchCRM in use and upgrade to version 7.0.0 or later if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.