CVE-2026-39327

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /MemberRoleChange.php in ChurchCRM 7.0.5. Authenticated users with the role Manage Groups & Roles (ManageGroups) can inject arbitrary SQL statements through the NewRole parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

• CWE-89

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66fc-v5xj-x859Third Party Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39321Parse Server is an open source backend that can be deployed …3.7
• CVE-2026-39322PolarLearn is a free and open-source learning program. In 0-…8.8
• CVE-2026-39323Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-39324Rack::Session is a session management implementation for Rac…9.8
• CVE-2026-39325ChurchCRM is an open-source church management system. Prior …7.2
• CVE-2026-39326ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-39328ChurchCRM is an open-source church management system. Prior …8.9
• CVE-2026-39329ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-39330ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-39331ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-39332ChurchCRM is an open-source church management system. Prior …8.7
• CVE-2026-39333ChurchCRM is an open-source church management system. Prior …8.7