CVE-2026-40593: ChurchCRM User Editor XSS Vulnerability

CVE-2026-40593 Overview

CVE-2026-40593 is a stored Cross-Site Scripting (XSS) vulnerability discovered in ChurchCRM, an open-source church management system. The vulnerability exists in the User Editor component (UserEditor.php) where stored usernames are rendered directly into an HTML input value attribute without proper sanitization using htmlspecialchars(). This allows an attacker with administrative privileges to inject malicious JavaScript that executes in the browsers of other administrators viewing the affected user's editor page.

Critical Impact

An administrator can craft a malicious username containing HTML attribute-breaking characters and event handlers, leading to stored XSS attacks that compromise other administrator sessions and potentially enable account takeover or further system compromise.

Affected Products

• ChurchCRM versions prior to 7.2.0
• ChurchCRM User Editor component (UserEditor.php)

Discovery Timeline

• 2026-04-18 - CVE CVE-2026-40593 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40593

Vulnerability Analysis

This stored XSS vulnerability stems from improper output encoding in the ChurchCRM User Editor functionality. When an administrator creates or modifies a user account, the username is stored in the database and later rendered on the User Editor page. The vulnerable code path in UserEditor.php takes the username value from the database and places it directly into an HTML input element's value attribute without applying proper encoding through PHP's htmlspecialchars() function.

The vulnerability requires administrator-level privileges to exploit, as only administrators can create or modify user accounts. However, the impact extends beyond the attacking administrator, as any administrator who subsequently views the malicious user's editor page will have the injected script execute in their browser context. This creates a scenario where a rogue or compromised administrator could attack other administrative users, potentially escalating their capabilities or exfiltrating sensitive data.

Root Cause

The root cause is a failure to apply proper output encoding when rendering user-controlled data in HTML context. The UserEditor.php file directly echoes the username variable into an HTML input's value attribute. Without htmlspecialchars() encoding, special characters like double quotes ("), angle brackets (<, >), and other HTML-significant characters are rendered as-is, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript.

This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant where malicious input persists in the application's data store.

Attack Vector

The attack follows a network-based vector requiring high privileges (administrator access) and user interaction (another administrator must view the affected page). An attacker with administrative access to ChurchCRM would:

1. Navigate to the user management functionality
2. Create or modify a user account with a specially crafted username containing HTML attribute escape sequences
3. The malicious username might include patterns like " onfocus="alert(document.cookie) or "><script>malicious_code</script><input value="
4. When another administrator opens the User Editor page for that user, the injected code executes in their browser session

The malicious script could then perform actions such as stealing session cookies, modifying page content, creating new administrator accounts, or redirecting the victim to phishing pages. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-40593

Indicators of Compromise

• Usernames in the ChurchCRM database containing HTML special characters such as ", <, >, or event handler patterns like onload, onerror, onfocus
• Web server access logs showing requests to UserEditor.php with unusual parameter values or referrer patterns
• Unexpected JavaScript execution or browser console errors when accessing user management pages
• Reports from administrators of unusual behavior when viewing user editor pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in HTTP request parameters targeting user management endpoints
• Deploy Content Security Policy (CSP) headers to restrict inline script execution and report policy violations
• Monitor application database for usernames containing suspicious HTML or JavaScript patterns
• Enable browser XSS auditing and review any triggered warnings in administrative interfaces

Monitoring Recommendations

• Configure centralized logging for all ChurchCRM administrative actions, particularly user creation and modification events
• Set up alerts for database entries containing potential XSS patterns in username or other user-controlled fields
• Monitor CSP violation reports for indicators of XSS attempts against the application
• Review access logs for the UserEditor.php endpoint for anomalous access patterns or suspicious referrers

How to Mitigate CVE-2026-40593

Immediate Actions Required

• Upgrade ChurchCRM to version 7.2.0 or later immediately
• Audit existing usernames in the database for any potentially malicious content containing HTML special characters
• Sanitize or remove any suspicious usernames discovered during the audit
• Review administrator access logs for any signs of exploitation

Patch Information

ChurchCRM has addressed this vulnerability in version 7.2.0. The fix applies proper HTML encoding using htmlspecialchars() when rendering usernames in the User Editor page. Organizations running ChurchCRM versions prior to 7.2.0 should upgrade immediately. Detailed patch information is available in the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, implement input validation on the server-side to reject usernames containing HTML special characters (", <, >, &)
• Deploy a Web Application Firewall (WAF) with XSS protection rules in front of the ChurchCRM application
• Implement Content Security Policy headers to mitigate the impact of any successful XSS exploitation
• Restrict administrative access to trusted users only and enable multi-factor authentication for all administrator accounts
• Regularly audit user accounts for suspicious username patterns

# Example: Database query to identify potentially malicious usernames
mysql -u churchcrm_user -p churchcrm_db -e "SELECT per_ID, per_FirstName, per_LastName FROM person_per WHERE per_FirstName LIKE '%<%' OR per_FirstName LIKE '%>%' OR per_FirstName LIKE '%\"%' OR per_LastName LIKE '%<%' OR per_LastName LIKE '%>%' OR per_LastName LIKE '%\"%';"