Public API Login Vulnerability in ChurchCRM by ChurchCRM

CVE-2026-40485

What is CVE-2026-40485?

ChurchCRM, an open-source church management system, has a vulnerability in its public API login endpoint that allows unauthenticated attackers to determine valid usernames. In versions before 7.2.0, the login endpoint returns distinct HTTP response codes for non-existent and valid usernames with incorrect passwords, enabling attackers to exploit this discrepancy. The absence of rate limiting or account lockout mechanisms further facilitates this enumeration attack, making it critical for users to update their systems to version 7.2.0 or later to mitigate this risk.

References