Known CVE

ChurchCRM - API Authentication Bypass via URL Injection

ChurchCRM < 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public

CVE-2026-39339

Critical2026CVSS 9.1CWE-284

cve2026 · churchcrm · auth-bypass

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website