{"id":"CVE-2026-42289","aliases":["EUVD-2026-29877"],"status":"published","title":"ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation","description":"ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00153,"percentile":0.04439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-306","CWE-352"],"published":"2026-05-12T22:23:25Z","modified":"2026-10-26T18:10:00Z","products":[{"vendor":"churchcrm","product":"crm"}],"references":[{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3xq9-c86x-cwpp","tags":["x_refsource_CONFIRM","exploit"]}],"sources":{"cve":[{"id":"CVE-2026-42289","title":"ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation","description":"ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.","status":"published","published":"2026-05-12T22:23:25.126Z","modified":"2026-05-14T12:36:48.339Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269","CWE-306","CWE-352"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-29877","description":"ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.","status":"published","published":"2026-05-12T22:23:25Z","modified":"2026-05-14T12:36:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:04:31.58892Z"}],"nvd":[{"id":"CVE-2026-42289","description":"ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.","status":"published","published":"2026-05-12T23:16:17.73Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269","CWE-306","CWE-352"],"updated_at":"2026-11-02T14:12:19.020465Z"}]}}