QwikSec

Security Database

CVE

CWE

Training

CVE-2026-40581

Published: Apr 17, 2026

Modified: Apr 20, 2026

PUBLISHED

CVSS v3.1

8.1

HIGH

Description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.

Vendor	Product	Versions
ChurchCRM	CRM	affected `< 7.2.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj

x_refsource_CONFIRM

https://github.com/ChurchCRM/CRM/pull/8613

x_refsource_MISC

https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.