ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control

⚡ Any authenticated user can suddenly become the Kiosk Manager! Before version 6.5.3 of ChurchCRM, broken access controls let users bypass permissions and wreak havoc in the kiosk features. 🤯 Think of it like a restaurant where anyone with a reservation can suddenly walk into the kitchen and start changing the menu. The Kiosk Manager should only be accessible to authorized staff, but this vulnerability allows unauthorized users to access it just like an uninvited guest hijacking the chef's station. This means that a mischievous user could allow themselves or others to register at kiosks, accept registrations, and even reload or identify kiosk settings. The potential for chaos is immense, as this could lead to unauthorized access to sensitive church data or even disruption of the registration process for events. Yikes!

This means that a mischievous user could allow themselves or others to register at kiosks, accept registrations, and even reload or identify kiosk settings. The potential for chaos is immense, as this could lead to unauthorized access to sensitive church data or even disruption of the registration process for events. Yikes! To secure your system, upgrade to ChurchCRM version 6.5.3 immediately. After updating, conduct an audit of user permissions related to kiosk functionalities to ensure only authorized personnel can access these critical features. Don't wait — act now! 🔒 You've got this! Follow these steps, and you'll help protect your church community's data like the superhero you are! 🦸‍♂️