CVE-2026-58408: ChurchCRM Auth Bypass Vulnerability

CVE-2026-58408 Overview

ChurchCRM is an open-source church management system used by congregations to track members, families, and donations. CVE-2026-58408 is a missing authorization vulnerability [CWE-862] affecting ChurchCRM versions prior to 7.4.0. A low-privileged authenticated user can bypass the /admin/export user interface and directly invoke the POST /CSVCreateFile.php endpoint. The endpoint streams a CSV file containing full Personally Identifiable Information (PII) for every Person and Family record in the database. The endpoint inherits only a coarse permission gate from the legacy page bootstrap, so any single non-admin permission flag grants access to the bulk export.

Critical Impact
Authenticated low-privileged users can exfiltrate the complete member directory, including PII for every Person and Family record.

Affected Products

ChurchCRM versions prior to 7.4.0
ChurchCRM CSVCreateFile.php bulk export endpoint
Deployments granting any non-admin permission flag to standard users

Discovery Timeline

2026-07-13 - CVE-2026-58408 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58408

Vulnerability Analysis

The vulnerability exists in the CSVCreateFile.php script, which generates and streams a CSV export containing every Person and Family record. The script relies on the legacy page bootstrap to enforce authorization. That bootstrap checks only whether the caller holds any admin-related permission, rather than verifying a dedicated data-export privilege. As a result, users assigned narrow, non-admin permission flags can reach the endpoint and receive the full PII dataset. The intended /admin/export user interface, which restricts export functionality, is bypassed entirely when the endpoint is called directly.

Root Cause

The root cause is a missing authorization check [CWE-862] within the export script itself. CSVCreateFile.php lacks a dedicated isAdmin() verification and does not consult a granular permission such as bExportData. Authorization is delegated to a shared page bootstrap that treats any admin-adjacent permission as sufficient, producing an over-permissive access decision for a sensitive bulk data operation.

Attack Vector

The attack requires network access to the ChurchCRM web application and valid credentials for a low-privileged account holding at least one qualifying permission flag. An attacker sends a POST request directly to /CSVCreateFile.php, bypassing the admin export UI. The server responds with a CSV stream containing PII for all Person and Family records. No user interaction, elevated privileges, or additional exploitation primitives are required.

No public proof-of-concept code has been published. See the ChurchCRM GitHub Security Advisory GHSA-4vj2-gm78-3q63 for vendor-provided technical detail.

Detection Methods for CVE-2026-58408

Indicators of Compromise

HTTP POST requests to /CSVCreateFile.php originating from accounts that do not hold administrative export privileges.
Unexpected CSV response payloads containing Person or Family records delivered to non-admin sessions.
Web server access logs showing bulk export activity outside the /admin/export UI workflow.

Detection Strategies

Correlate authenticated session identity with requests to CSVCreateFile.php and alert when the caller lacks a dedicated export role.
Baseline the volume and frequency of CSV export operations, then flag deviations from established administrator behavior.
Inspect referrer headers on export requests to identify calls that bypass the intended /admin/export navigation flow.

Monitoring Recommendations

Enable verbose web server and application logging for all /CSVCreateFile.php invocations, including user, timestamp, and response size.
Forward ChurchCRM application and web server logs to a central SIEM or data lake for correlation with authentication events.
Alert on any single account generating multiple bulk CSV exports within a short time window.

How to Mitigate CVE-2026-58408

Immediate Actions Required

Upgrade ChurchCRM to version 7.4.0 or later, which introduces the missing authorization check on the export endpoint.
Review all user accounts and remove non-admin permission flags from users who do not require them.
Audit web server logs for prior unauthorized calls to /CSVCreateFile.php and treat matches as potential PII exfiltration.

Patch Information

The issue is fixed in ChurchCRM 7.4.0. Refer to the ChurchCRM GitHub Security Advisory GHSA-4vj2-gm78-3q63 for release notes and upgrade guidance.

Workarounds

Restrict network access to the ChurchCRM administrative surface using a reverse proxy or web application firewall rule that blocks /CSVCreateFile.php for non-administrative sessions.
Temporarily revoke any non-essential permission flags from standard user roles until the upgrade to 7.4.0 is completed.
Require additional network-layer authentication, such as VPN or IP allowlisting, for access to the ChurchCRM administrative directory.

bash

# Example nginx rule to block direct access to the vulnerable endpoint
# until an upgrade to ChurchCRM 7.4.0 is completed
location = /CSVCreateFile.php {
    allow 10.0.0.0/24;   # administrative subnet
    deny all;
    return 403;
}