PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated May 4, 2026

ChurchCRM - API Authentication Bypass via URL Injection

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
3.2k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
9.1
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
CRMby ChurchCRM
< 7.1.0
Updated Sep 18, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

ChurchCRM - API Authentication Bypass via URL Injection CVE-2026-39339 Scanner | S4E