Unauthorized Data Exposure in ChurchCRM by Beagle Software

CVE-2026-40480

What is CVE-2026-40480?

In ChurchCRM, the open-source church management system, an authorization bypass vulnerability exists within the GET /api/person/{personId} endpoint prior to version 7.2.0. This vulnerability allows authenticated users with limited EditSelf privileges to access and retrieve sensitive personal information of other members—including names, addresses, phone numbers, and email addresses—without proper object-level authorization checks. This oversight in the API layer, which fails to verify the canEditPerson() restrictions enforced in the legacy interface, raises significant privacy concerns. The issue has been addressed in version 7.2.0, emphasizing the importance of keeping software updated to mitigate similar vulnerabilities.

References