What’s Vulnerable › Vulnerabilities

CVE-2026-40485: ChurchCRM: Username Enumeration via Differential Response in Public Login API

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-18 · updated 2026-10-26
• Weakness: CWE-204

Description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.

Affected products

• ChurchCRM CRM: before 7.2.0

References

• https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850
• https://github.com/ChurchCRM/CRM/pull/8607
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx

Get alerted when CVE-2026-40485 or the next vulnerability affects your stack