CVE-2026-39338: ChurchCRM Blind Reflected XSS Vulnerability

CVE-2026-39338 Overview

CVE-2026-39338 is a Blind Reflected Cross-Site Scripting (XSS) vulnerability affecting ChurchCRM, an open-source church management system. Prior to version 7.1.0, the application fails to sanitize or encode user-supplied input in the search parameter accepted by the ChurchCRM dashboard. This allows attackers to inject malicious scripts that execute in the context of the victim's browser session.

Although the application ultimately returns an HTTP 500 error due to the malformed API request caused by the payload, the browser's JavaScript engine parses and executes the injected <script> tags before the error response is returned — resulting in successful code execution regardless of the server-side error.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in authenticated user sessions, potentially leading to session hijacking, credential theft, and unauthorized access to sensitive church member data.

Affected Products

• ChurchCRM versions prior to 7.1.0
• ChurchCRM dashboard search functionality

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-39338 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39338

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in how the ChurchCRM dashboard processes user-supplied search parameters without proper input validation or output encoding.

The attack requires network access and user interaction, where a victim must click a maliciously crafted link or visit a page containing the exploit payload. Once triggered, the injected JavaScript executes with the privileges of the authenticated user, potentially compromising confidentiality and integrity of the application data.

Root Cause

The root cause of this vulnerability is the absence of proper input sanitization and output encoding in the search parameter handling logic of the ChurchCRM dashboard. When user-controlled input is reflected back into the page's DOM without escaping HTML special characters, it allows attackers to break out of the intended data context and inject executable script content.

The application's server-side error handling does not prevent client-side script execution, as the browser's JavaScript engine processes and executes injected code before the HTTP 500 error response is fully rendered.

Attack Vector

The attack is executed via network-based social engineering, where an attacker crafts a malicious URL containing JavaScript payload in the search parameter. The attack flow typically involves:

1. Attacker constructs a malicious URL with XSS payload targeting the ChurchCRM dashboard search functionality
2. Victim (authenticated ChurchCRM user) clicks the malicious link or is redirected to it
3. The search parameter containing the payload is processed by the application
4. Despite triggering an HTTP 500 error, the browser executes the injected script tags
5. Malicious JavaScript runs in the context of the victim's authenticated session

The vulnerability can be exploited to steal session cookies, capture user credentials, perform actions on behalf of the victim, or redirect users to phishing pages. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-39338

Indicators of Compromise

• Unusual URL patterns in web server access logs containing <script> tags or encoded script content in search parameters
• HTTP 500 errors preceded by requests to the dashboard with suspicious search query strings
• Reports of unexpected browser behavior or redirects from ChurchCRM users
• Evidence of session cookie exfiltration or unauthorized account access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing common XSS patterns in query parameters
• Monitor web server logs for requests to the ChurchCRM dashboard containing encoded or plaintext script tags
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution violations
• Use browser-based XSS auditing tools during security assessments to identify reflected input

Monitoring Recommendations

• Enable detailed logging for all requests to the ChurchCRM dashboard, particularly the search endpoint
• Configure alerting for anomalous patterns such as multiple HTTP 500 errors with suspicious query strings from the same source
• Monitor for signs of credential theft or unauthorized administrative actions following potential XSS attacks
• Regularly review access logs for indicators of social engineering campaigns targeting ChurchCRM users

How to Mitigate CVE-2026-39338

Immediate Actions Required

• Upgrade ChurchCRM to version 7.1.0 or later immediately
• Implement Content Security Policy (CSP) headers to mitigate the impact of any XSS vulnerabilities
• Review user accounts for signs of compromise, particularly those with administrative privileges
• Educate users about the risks of clicking untrusted links

Patch Information

This vulnerability is fixed in ChurchCRM version 7.1.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper input sanitization and output encoding for user-supplied search parameters.

For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block requests containing XSS patterns in query parameters
• Implement strict Content Security Policy headers to prevent inline script execution: script-src 'self'
• Restrict access to the ChurchCRM dashboard to trusted networks or VPN-only access until patching is complete
• Consider temporarily disabling the search functionality if feasible until the upgrade can be performed

# Example Apache configuration for Content Security Policy header
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"