CVE-2026-40480

🗓️ 17 Apr 2026 23:07:30Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 4 Views🌐 WEB

CVE-2026-40480: ChurchCRM prior to 7.2.0 exposes /api/person/{personId} without auth, enabling EditSelf users to view others' data.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-40480	17 Apr 202623:07	–	attackerkb
Circl	CVE-2026-40480	18 Apr 202601:18	–	circl
CNNVD	ChurchCRM 安全漏洞	18 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-40480 ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`	17 Apr 202623:07	–	cvelist
EUVD	EUVD-2026-23589	17 Apr 202623:07	–	euvd
NVD	CVE-2026-40480	18 Apr 202600:16	–	nvd
Positive Technologies	PT-2026-33525	17 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-40480	20 Apr 202619:22	–	redhatcve
Vulnrichment	CVE-2026-40480 ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`	17 Apr 202623:07	–	vulnrichment

Vulners

Node

churchcrm crmRange<7.2.0

[
  {
    "vendor": "ChurchCRM",
    "product": "CRM",
    "versions": [
      {
        "version": "< 7.2.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ChurchCRM/CRM/security/advisories/GHSA-5w59-32c8-933v
github	www.github.com/ChurchCRM/CRM/pull/8616
github	www.github.com/ChurchCRM/CRM/commit/28ea7a2965fc2fe30e150fadb1ae38a97f8225c2
github	www.github.com/ChurchCRM/CRM/issues/8617

Parameter	Position	Path	Description	CWE
personId	path	/api/person/{personId}	API returns person records without object-level authorization, enabling enumeration/read of other members by authenticated users with limited privileges.	CWE-639, CWE-862

17 Jun 2026 10:45Current

5.7Medium risk

Vulners AI Score5.7

CVSS 47.1

EPSS0.00336

SSVC