Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user's API key, bypassing the normal authentication flow that enforces account lockout and two-factor authentication checks. An attacker with knowledge of a user's password can obtain API access even when the account is locked or has 2FA enabled, granting direct access to all protected API endpoints with that user's privileges. This issue has been fixed in version 7.2.0. Note: this issue had a duplicate, GHSA-472m-p3gf-46xp, which has been closed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-40582 ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before … https://www.cve.org/CVERecord?id=CVE-2026-40582
Post summary
A brief disclosure notes that CVE‑2026‑40582 affects ChurchCRM versions before 7.2.0 via the /api/public/user/login endpoint, but offers no technical details, PoC, or patch information.
🚨 CVE-2026-40582: ChurchCRM: Aut... API endpoint sidesteps entire auth stack - password alone grants full API access, making 2FA and lockouts worthless #authbypass #apihack. https://zerodaysignal.com/vulnerability/CVE-2026-40582 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A newly disclosed authentication bypass vulnerability (CVE‑2026‑40582) in ChurchCRM permits password-only API access, undermining 2FA and lockout mechanisms.