CVE-2026-58410 Overview
ChurchCRM, an open-source church management system, contains an authorization flaw in its family-scoped endpoints prior to version 7.4.0. Authenticated non-admin users holding EditSelf permission can supply another family's familyId to read and modify records outside their own family scope. The backend loads the family entity by the attacker-supplied ID without verifying ownership. When the same account also holds Notes permission, the attacker can create notes on unrelated family records. The issue is classified as an Insecure Direct Object Reference weakness [CWE-639] and is fixed in ChurchCRM version 7.4.0.
Critical Impact
Low-privileged authenticated users can read and modify other families' congregation records, breaking the intended EditSelf scope and exposing sensitive personal data across the tenant.
Affected Products
- ChurchCRM versions prior to 7.4.0
- ChurchCRM family-scoped API endpoints
- ChurchCRM deployments granting EditSelf or Notes permissions to non-admin users
Discovery Timeline
- 2026-07-13 - CVE-2026-58410 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-58410
Vulnerability Analysis
The vulnerability resides in ChurchCRM endpoints that accept a familyId parameter to scope operations to the current user's family. The backend trusts the client-supplied identifier and retrieves the corresponding family entity directly by primary key. No server-side check confirms that the requested familyId matches the family associated with the authenticated user.
A non-admin account with EditSelf permission can substitute any valid familyId and receive the target family's data in response. If the same account also holds Notes permission, it can attach notes to arbitrary family records. This behavior violates the intended EditSelf scope, which should restrict data access to the acting user's own family.
The flaw exposes personal congregation data including household composition, contact details, and any notes attached to family records. Impact is limited to confidentiality and partial integrity because attackers cannot escalate to administrative functions or affect service availability.
Root Cause
The root cause is missing authorization enforcement on family-scoped resource lookups, a classic Insecure Direct Object Reference pattern [CWE-639]. The application authenticates the session but fails to authorize the requested object against the caller's ownership claim before returning or mutating data.
Attack Vector
Exploitation requires an authenticated ChurchCRM account with EditSelf permission. The attacker sends a request to a family-scoped endpoint and replaces their own familyId value with a target family's identifier. Family IDs are sequential integers, making enumeration straightforward. The attack is fully remote over HTTP and requires no user interaction. See the GitHub Security Advisory for additional technical detail.
Detection Methods for CVE-2026-58410
Indicators of Compromise
- Web server access logs showing a single authenticated user session issuing requests with varying familyId values in rapid succession
- Application audit logs recording notes created by a non-admin user against families other than their own
- HTTP requests to family-scoped endpoints where the request familyId does not match the session user's assigned family
Detection Strategies
- Review ChurchCRM application logs for familyId enumeration patterns from low-privileged accounts
- Correlate authenticated user identity with the familyId parameter in reverse-proxy or WAF logs to flag mismatches
- Alert on any note creation events where the acting user's family does not equal the target record's family
Monitoring Recommendations
- Ingest ChurchCRM web and application logs into a centralized log platform for cross-session correlation
- Baseline normal request volume per user and alert on sudden spikes in family-scoped endpoint access
- Monitor database audit trails for family_fam and note_nte table reads and writes performed outside the session user's scope
How to Mitigate CVE-2026-58410
Immediate Actions Required
- Upgrade ChurchCRM to version 7.4.0 or later, which enforces family ownership checks on scoped endpoints
- Audit user accounts holding EditSelf and Notes permissions and revoke rights that are not operationally required
- Review application and database logs since the last upgrade for evidence of cross-family access
Patch Information
The fix is included in ChurchCRM 7.4.0. The patch adds server-side validation that the requested familyId belongs to the authenticated user before loading the family entity or permitting modifications. Details are published in the ChurchCRM GHSA-jjcj-h3cm-p7x7 advisory.
Workarounds
- Restrict ChurchCRM access to trusted users only until the 7.4.0 upgrade is applied
- Temporarily remove Notes permission from non-admin roles to prevent unauthorized note creation on other families
- Place ChurchCRM behind a reverse proxy or WAF that logs and rate-limits requests to family-scoped endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
