Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.0
CVE-2026-35575: ChurchCRM group creation lets attacker steal admin cookies
CVE-2026-35575 · published 7 months ago
Summary
The church management software ChurchCRM (versions before 6.5.3) lets anyone who can create groups add hidden code that runs when an administrator opens the group page. That code can capture the admin’s login information, giving a attacker full control of the system. Update to version 6.5.3 or later to stop this from happening.
What to do
- Update churchcrm churchcrm to version 6.5.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| churchcrm | churchcrm |
< 6.5.3 cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* |
Original advisory text
ChurchCRM has Stored XSS in Group Name
ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator views the page. This enables attackers to steal the administrator’s session cookies, potentially leading to full administrative account takeover. This vulnerability is fixed in 6.5.3.
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35575... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-35575 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
CWE-1004Sensitive Cookie Without 'HttpOnly' Flag
Timeline
Published7 Apr 2026
Updated4 Nov 2026
First seen7 Apr 2026
Track software like this
Free during beta