A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.
References
| Link | Resource |
|---|---|
| https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 | Patch |
| https://github.com/ChurchCRM/CRM/pull/7376 | Issue Tracking |
| https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.327667 | Permissions Required VDB Entry |
| https://vuldb.com/?id.327667 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.669916 | Third Party Advisory VDB Entry |
| https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md | Exploit Third Party Advisory |
Configurations
History
24 Feb 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue. |
27 Oct 2025, 18:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 - Patch | |
| References | () https://github.com/ChurchCRM/CRM/pull/7376 - Issue Tracking | |
| References | () https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.327667 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.327667 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.669916 - Third Party Advisory, VDB Entry | |
| First Time |
Churchcrm
Churchcrm churchcrm |
|
| CPE | cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* |
09 Oct 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md - |
09 Oct 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-09 03:15
Updated : 2026-02-24 07:16
NVD link : CVE-2025-11529
Mitre link : CVE-2025-11529
CVE.ORG link : CVE-2025-11529
JSON object : View
Products Affected
churchcrm
- churchcrm