CVE-2025-11529CWE-287CWE-306

CVE-2025-11529

High · published October 9, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.8th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2025-10-09T07:15Z
Affected products (1)
ProductVersionsFixed in
churchcrm/churchcrm< 5.19.05.19.0
References (7)
https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 · [email protected]https://github.com/ChurchCRM/CRM/pull/7376 · [email protected]https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md · [email protected]https://vuldb.com/?ctiid.327667 · [email protected]https://vuldb.com/?id.327667 · [email protected]https://vuldb.com/?submit.669916 · [email protected]https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 03:02Z
    ChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authentication
    cvelistv5