CVE-2026-58408

{
  "id": "CVE-2026-58408",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-13T20:16:49.770",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse \"has any admin permission\" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0."
    },
    {
      "lang": "es",
      "value": "ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 7.4.0, un usuario con pocos privilegios puede eludir la interfaz de usuario /admin/export y exfiltrar todo el directorio de miembros. El endpoint POST /CSVCreateFile.php genera y transmite un CSV que contiene la Información de Identificación Personal (PII) completa de cada registro de Persona/Familia en la base de datos, sin realizar ninguna comprobación de autorización a nivel de característica o a nivel de objeto más allá de la puerta de enlace general ’tiene algún permiso de administrador’ heredada del bootstrap de la página heredada. En otras palabras, cualquier bandera de permiso no-administrador es suficiente para alcanzar el endpoint de exportación masiva de CSV, a pesar de que dichos usuarios no deberían tener derechos de exportación de datos. El script de exportación carece de una comprobación de autorización dedicada isAdmin() (o una nueva bExportData) propia. Este problema ha sido solucionado en la versión 7.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ChurchCRM",
          "product": "CRM",
          "versions": [
            {
              "version": "< 7.4.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T12:57:23.509918Z",
          "id": "CVE-2026-58408",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4vj2-gm78-3q63",
      "source": "[email protected]"
    }
  ]
}