ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion

The impact of this CSRF vulnerability is significant due to the irreversible nature of the data deletion. An attacker could craft a malicious webpage that, when visited by an authenticated ChurchCRM administrator, would silently trigger the deletion of targeted family records. This includes associated notes, pledges, persons, and property data, effectively wiping critical information from the church's database. The lack of user interaction makes this attack particularly stealthy, as the administrator may be unaware that data has been compromised. Successful exploitation could lead to significant disruption of church operations and potential loss of sensitive member information.

1. Reserviert2026-04-14
2. Veröffentlicht2026-04-17
3. Geändert2026-04-20
4. EPSS aktualisiert2026-04-25

The primary mitigation for CVE-2026-40581 is to upgrade ChurchCRM to version 7.2.0 or later, which includes the necessary CSRF protection. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the SelectDelete.php endpoint that lack a valid CSRF token. Alternatively, restrict access to this endpoint to trusted networks or users. Carefully review ChurchCRM's configuration to ensure that administrator accounts are secured with strong passwords and multi-factor authentication to reduce the risk of account compromise.