Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-12 | 2 | Disclosure2 |
| 2026-05-13 | 1 | Disclosure1 |
CVE-2026-42289 Cross-Site Request Forgery in ChurchCRM Prior to Version 7.3.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42289
Post summary
The post reveals a CVE‑2026‑42289 CSRF flaw in ChurchCRM before version 7.3.2, offering minimal technical details and no indications of exploitation or mitigation.
⚠️ HIGH — CVE-2026-42289 ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation an… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-42289 #HP #CyberSecurity #InfoSec
Post summary
The tweet alerts on a newly disclosed CVE-2026-42289 in ChurchCRM, providing a high CVSS score and a link to an analysis, but offers no deeper technical or exploitation information.
CVE-2026-42289 ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST pa… https://www.cve.org/CVERecord?id=CVE-2026-42289
Post summary
The post discloses CVE‑2026‑42289, describing how ChurchCRM’s UserEditor.php processes user account creation via $_POST and notes that the issue is addressed in version 7.3.2.