What’s Vulnerable › Vulnerabilities

CVE-2021-32691: Auto-merging Person Records Compromised

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-16 · updated 2026-06-17
• Weakness: CWE-303

Description

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class.

Affected products

• Apollosapp Data-Connector-Rock: before 2.20.0 — fixed in 2.20.0

How to fix

Upgrade to a fixed version: Apollosapp Data-Connector-Rock 2.20.0. Check the vendor advisory for mitigations.

References

• https://github.com/ApollosProject/apollos-apps/commit/cb5f8f1c0b24f1b215b2bb5eb6f9a8e16d728ce2
• https://github.com/ApollosProject/apollos-apps/releases/tag/v2.20.0
• https://github.com/ApollosProject/apollos-apps/security/advisories/GHSA-r578-pj6f-r4ff
• https://github.com/ApollosProject/apollos-apps/commit/cb5f8f1c0b24f1b215b2bb5eb6f9a8e16d728ce2
• https://github.com/ApollosProject/apollos-apps/releases/tag/v2.20.0
• https://github.com/ApollosProject/apollos-apps/security/advisories/GHSA-r578-pj6f-r4ff

Get alerted when CVE-2021-32691 or the next vulnerability affects your stack