QwikSec

Security Database

CVE

CWE

Training

CVE-2026-40485

Published: Apr 17, 2026

Modified: Apr 20, 2026

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.

Vendor	Product	Versions
ChurchCRM	CRM	affected `< 7.2.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx

x_refsource_CONFIRM

https://github.com/ChurchCRM/CRM/pull/8607

x_refsource_MISC

https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.