CVE-2026-44547 Auth bypass in CRM
Attackers can bypass two-factor authentication and account lockout via the public API in ChurchCRM, potentially taking over accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44547?
CVE-2026-44547 is a critical authentication bypass vulnerability in ChurchCRM CRM, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.
Which versions are affected by CVE-2026-44547?
How do I fix CVE-2026-44547?
No fix has been published for CVE-2026-44547 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-44547 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44547 exists.
Sources
Also known as GHSA-cwp8-rm8g-q5c9.