CVE-2026-40485 ChurchCRM: Username Enumeration via Differential Response in Public Login API
Unauthenticated attackers can enumerate valid usernames via differential HTTP responses in the public login API, facilitating targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40485?
CVE-2026-40485 is a medium-severity vulnerability in ChurchCRM CRM, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.
Which versions are affected by CVE-2026-40485?
How do I fix CVE-2026-40485?
No fix has been published for CVE-2026-40485 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40485 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40485 exists.
Sources
Also known as GHSA-x2qh-xmhq-4jpx.