CVE-2026-58411 ChurchCRM CVE debrief

Who should care

Administrators and users of ChurchCRM versions prior to 7.4.0 should be aware of this vulnerability and take steps to mitigate it. This vulnerability could lead to session-token theft, account takeover, unauthorized actions on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing, and privilege escalation when administrators are targeted. Operators, platform administrators, vulnerability management teams, and security teams should review the affected scope and severity to determine potential impact on their environments.

Technical summary

The CVE-2026-58411 vulnerability is a Cross-Site Scripting (XSS) issue in ChurchCRM, an open-source church management system. The vulnerability exists due to insufficient output encoding of user-controlled request parameter names and parameter values. This allows an attacker to inject malicious code into the application, which can then be executed by other users. The affected endpoints observed during testing are /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. The vulnerability can be mitigated by upgrading to version 7.4.0 or later and implementing additional security measures.

Defensive priority

High

Recommended defensive actions

• Upgrade ChurchCRM to version 7.4.0 or later
• Implement additional security measures such as input validation and output encoding
• Monitor for suspicious activity and implement incident response plans
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-13T22:16:48.270Z and has not been modified since then. The NVD entry is currently being processed. Evidence and details are limited to publicly available information and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected scope and severity with the vendor and consider potential exposure in their environments.

Official resources