CVE-2026-44547CWE-287CWE-304

ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

Critical · published May 12, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00363 · 29.0th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-304 · Missing Critical Step in Authentication
Published
2026-05-12T22:30Z
EPSS history
Timeline
  • 12 MAY 22:30Z
    ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2
    cvelistv5