CVE-2026-40581

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40581", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-14T13:24:29.475Z", "datePublished": "2026-04-17T23:51:32.765Z", "dateUpdated": "2026-04-20T16:15:58.183Z"}, "containers": {"cna": {"title": "ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj"}, {"name": "https://github.com/ChurchCRM/CRM/pull/8613", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChurchCRM/CRM/pull/8613"}, {"name": "https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674"}], "affected": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"version": "< 7.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:51:32.765Z"}, "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0."}], "source": {"advisory": "GHSA-6qxv-xw9j-77pj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T16:09:32.310175Z", "id": "CVE-2026-40581", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:15:58.183Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40581", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:09:32.310175Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:09:34.463Z"}}], "cna": {"title": "ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion", "source": {"advisory": "GHSA-6qxv-xw9j-77pj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.2.0"}]}], "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj", "name": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ChurchCRM/CRM/pull/8613", "name": "https://github.com/ChurchCRM/CRM/pull/8613", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674", "name": "https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:51:32.765Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40581", "state": "PUBLISHED", "dateUpdated": "2026-04-20T16:15:58.183Z", "dateReserved": "2026-04-14T13:24:29.475Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T23:51:32.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CRM", "vendor": "ChurchCRM", "versions": [{"status": "affected", "version": "< 7.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. En versiones anteriores a la 7.2.0, el endpoint de eliminaci\u00f3n de registros familiares (SelectDelete.php) realiza la eliminaci\u00f3n permanente e irreversible de registros familiares y todos los datos asociados a trav\u00e9s de una solicitud GET simple sin validaci\u00f3n de token CSRF. Un atacante puede crear una p\u00e1gina maliciosa que, al ser visitada por un administrador autenticado, activa silenciosamente la eliminaci\u00f3n de registros familiares espec\u00edficos, incluyendo notas asociadas, promesas de donaci\u00f3n, personas y datos de propiedad, sin ninguna interacci\u00f3n del usuario. Este problema ha sido solucionado en la versi\u00f3n 7.2.0."}], "id": "CVE-2026-40581", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40581", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T16:09:32.310175Z", "version": "2.0.3"}}]}, "published": "2026-04-18T00:16:39.683", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChurchCRM/CRM/pull/8613"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.0)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "CRM", "source": "cna", "vendor": "ChurchCRM"}, "product": "churchcrm", "vendor": "churchcrm"}], "analysis": {"en": {"generated_at": "2026-04-18T08:44:36.128931+00:00", "value": {"mitigation_remediation": ["Upgrade ChurchCRM to version 7.2.0 or later.", "Verify that any delete actions require explicit CSRF token validation and are not performed with a GET request.", "Ensure that only properly authorized users can initiate this deletion action, enforcing role\u2011based access controls."], "summary": {"action": "Apply Patch", "impact": "Permanent Data Deletion via CSRF"}, "threat_synthesis": {"affected_systems": "ChurchCRM:CRM applications running any build older than version 7.2.0 are affected. No other vendors or product lines are listed. Exact patches start at 7.2.0 where the issue is remedied.", "description_and_impact": "In ChurchCRM versions before 7.2.0 a family record deletion workflow in SelectDelete.php accepts a plain GET request without CSRF token validation, allowing a malicious page to silently delete family records and all related details, including notes, pledges, persons and property data. The deletion is irreversible, leading to total loss of both structured data and contextual information owned by an administrator\u2019s organization. The flaw stems from missing CSRF protection and insufficient authorization checks, allowing any authenticated administrator to trigger these destructive actions without interaction.", "risk_and_exploitability": "The CVSS base score of 8.1 marks this as a high\u2011severity vulnerability, while the EPSS score is not published and it is not in the CISA KEV catalog. A threat actor can exploit the flaw remotely by hosting a malicious webpage that causes an authenticated administrator\u2019s browser to make the vulnerable GET request; no user interaction beyond navigation to the page is required. The impact is data loss, and the risk is considerable given the ease of exploitation and the strong damages to the affected organization."}}}}, "created": "2026-04-18T08:45:41.389414+00:00", "updated": "2026-04-20T14:59:03.642390+00:00", "vendors": ["churchcrm", "churchcrm$PRODUCT$churchcrm"]}