CVE-2026-35576

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35576", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-03T20:09:02.827Z", "datePublished": "2026-04-07T17:11:24.846Z", "dateUpdated": "2026-04-09T15:46:32.060Z"}, "containers": {"cna": {"title": "ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv"}, {"name": "https://github.com/ChurchCRM/CRM/pull/8016", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChurchCRM/CRM/pull/8016"}], "affected": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"version": "< 7.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T17:11:24.846Z"}, "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability exists in ChurchCRM within the Person Property Management subsystem. This issue persists in versions patched for CVE-2023-38766 and allows an authenticated user to inject arbitrary JavaScript code via dynamically assigned person properties. The malicious payload is persistently stored and executed when other users view the affected person profile or access the printable view, potentially leading to session hijacking or full account compromise. This vulnerability is fixed in 7.0.0."}], "source": {"advisory": "GHSA-8r36-fvxj-26qv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T15:45:04.991207Z", "id": "CVE-2026-35576", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T15:46:32.060Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35576", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T15:45:04.991207Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T15:46:03.190Z"}}], "cna": {"title": "ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php", "source": {"advisory": "GHSA-8r36-fvxj-26qv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.0.0"}]}], "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv", "name": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ChurchCRM/CRM/pull/8016", "name": "https://github.com/ChurchCRM/CRM/pull/8016", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability exists in ChurchCRM within the Person Property Management subsystem. This issue persists in versions patched for CVE-2023-38766 and allows an authenticated user to inject arbitrary JavaScript code via dynamically assigned person properties. The malicious payload is persistently stored and executed when other users view the affected person profile or access the printable view, potentially leading to session hijacking or full account compromise. This vulnerability is fixed in 7.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T17:11:24.846Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35576", "state": "PUBLISHED", "dateUpdated": "2026-04-09T15:46:32.060Z", "dateReserved": "2026-04-03T20:09:02.827Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T17:11:24.846Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CRM", "vendor": "ChurchCRM", "versions": [{"status": "affected", "version": "< 7.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "matchCriteriaId": "35301BC9-6C61-4AF8-BB9E-FEE2053BA73F", "versionEndExcluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability exists in ChurchCRM within the Person Property Management subsystem. This issue persists in versions patched for CVE-2023-38766 and allows an authenticated user to inject arbitrary JavaScript code via dynamically assigned person properties. The malicious payload is persistently stored and executed when other users view the affected person profile or access the printable view, potentially leading to session hijacking or full account compromise. This vulnerability is fixed in 7.0.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de la versi\u00f3n 7.0.0, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en ChurchCRM dentro del subsistema de Gesti\u00f3n de Propiedades de Personas. Este problema persiste en versiones parcheadas para CVE-2023-38766 y permite a un usuario autenticado inyectar c\u00f3digo JavaScript arbitrario a trav\u00e9s de propiedades de persona asignadas din\u00e1micamente. La carga \u00fatil maliciosa se almacena y ejecuta persistentemente cuando otros usuarios ven el perfil de la persona afectada o acceden a la vista imprimible, lo que podr\u00eda llevar al secuestro de sesi\u00f3n o a la completa compromiso de la cuenta. Esta vulnerabilidad se corrige en la versi\u00f3n 7.0.0."}], "id": "CVE-2026-35576", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35576", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T15:45:04.991207Z", "version": "2.0.3"}}]}, "published": "2026-04-07T18:16:42.273", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ChurchCRM/CRM/pull/8016"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.0)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "CRM", "source": "cna", "vendor": "ChurchCRM"}, "product": "churchcrm", "vendor": "churchcrm"}], "analysis": {"en": {"generated_at": "2026-04-09T21:36:40.729039+00:00", "value": {"mitigation_remediation": ["Apply the latest official patch by upgrading to ChurchCRM version 7.0.0 or later.", "Verify that the upgrade successfully removed the vulnerable code path; test by attempting to inject payload into a person property and confirming it does not execute.", "Restrict editing permissions on person properties to the minimum required users to reduce attack potential.", "Regularly monitor the ChurchCRM community advisories and security bulletins for future updates."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting (XSS) with potential account compromise"}, "threat_synthesis": {"affected_systems": "All installations of ChurchCRM running versions prior to 7.0.0 are affected, including those that applied the patch for CVE\u20112023\u201138766. The flaw resides in the PrintView.php component that renders person properties. Users with editing privileges on person records\u2014typically church staff or administrators\u2014can use the vulnerability, while unauthenticated users cannot inject code.", "description_and_impact": "ChurchCRM, an open\u2011source church management system, contains a stored cross\u2011site scripting vulnerability in its Person Property Management subsystem. An authenticated user can inject arbitrary JavaScript into a dynamically assigned person property. Because the payload is stored in the database, it is executed whenever another user views the affected person\u2019s profile or accesses the printable view, which can enable session hijacking or full account compromise.", "risk_and_exploitability": "The CVSS score of 8.7 indicates high severity, yet the EPSS score is below 1\u202f% and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Knock\u2011on risk remains because only authenticated users with access to person properties can disclose payloads, but given that this privilege is common among internal users, the threat surface is relatively high for organizations that do not restrict such access."}}}}, "created": "2026-04-08T19:47:24.699987+00:00", "updated": "2026-04-10T09:41:24.148907+00:00", "vendors": ["churchcrm", "churchcrm$PRODUCT$churchcrm"]}