CVE-2026-58408

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

• CWE-862
• CWE-863

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63

Published

Jul 13, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58399@acastellon/auth is an authentication control system for mic…8.7
• CVE-2026-5840A security flaw has been discovered in PHPGurukul News Porta…4.7
• CVE-2026-58402Hugo is a static site generator. From 0.60.0 until 0.163.3, …5.4
• CVE-2026-58403Hugo is a static site generator. From v0.123.0 through v0.16…6.5
• CVE-2026-58404Hugo is a static site generator. From v0.162.0 through v0.16…6.8
• CVE-2026-58407Rejected reason: Please submit CVE requests for each vulnera…
• CVE-2026-58409ChurchCRM is an open-source church management system. Prior …9.1
• CVE-2026-5841A weakness has been identified in Tenda i3 1.0.0.6(2204). Th…9.8
• CVE-2026-58410ChurchCRM is an open-source church management system. Prior …7.1
• CVE-2026-58411ChurchCRM is an open-source church management system. Prior …7
• CVE-2026-58413Network-AI is a TypeScript/Node.js multi-agent orchestrator.…6.1
• CVE-2026-58414Network-AI is a TypeScript/Node.js multi-agent orchestrator.…5.5