Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-44547: ChurchCRM public API login bypasses 2FA and lockout
CVE-2026-44547 · published 5 months ago
Summary
Versions 7.2.0 through 7.2.2 of ChurchCRM still allow someone to log in through the public API without needing two‑factor authentication or triggering account lockout. This means an attacker could gain access to user accounts even if extra security measures are in place. Upgrade to ChurchCRM 7.3.1 or later to close the gap.
Original advisory text
ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-287Improper Authentication
CWE-304Missing Critical Step in Authentication
Timeline
Published12 May 2026
Updated4 Nov 2026
First seen12 May 2026
Track software like this
Free during beta