Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-13 | 2 | Disclosure2 |
| 2026-07-14 | 1 | Patch1 |
ChurchCRM fixed a critical vulnerability (CVE-2026-58408) allowing low-privileged users to exfiltrate full member directories via CSV export, rated CVSS 6․5. https://ift.tt/MtVTksQ
Post summary
ChurchCRM has released a patch for CVE-2026-58408, a low-privileged CSV export flaw rated CVSS 6.5.
🚨*CVE* CVE-2026-58408 ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member d… https://www.cve.org/CVERecord?id=CVE-2026-58408 ----- Traducción: CVE-2026-58408 Chu… http://infoflow.cloud`
Post summary
CVE-2026-58408 describes a low‑privilege bypass in ChurchCRM that lets users export the entire member database via the /admin/export UI before version 7.4.0. No exploit code, patch, or active exploitation claim is included.
CVE-2026-58408 ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member d… https://www.cve.org/CVERecord?id=CVE-2026-58408
Post summary
The text discloses that CVE-2026-58408 in ChurchCRM allows low‑privileged users to bypass the /admin/export UI and exfiltrate all member data. No PoC, active exploitation, or patch is referenced.