CVE-2026-40485

🗓️ 17 Apr 2026 23:29:35Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 45 Views🌐 WEB

Public login API reveals username existence via 404 vs 401, enabling enumeration; fixed in 7.2.0.

Reporter	Title	Published	Views	Family All 10
attackerkb	CVE-2026-40485	17 Apr 202623:29	–	attackerkb
Circl	CVE-2026-40485	18 Apr 202602:02	–	circl
CNNVD	ChurchCRM 安全漏洞	18 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-40485 ChurchCRM: Username Enumeration via Differential Response in Public Login API	17 Apr 202623:29	–	cvelist
EUVD	EUVD-2026-23599	17 Apr 202623:29	–	euvd
NVD	CVE-2026-40485	18 Apr 202600:16	–	nvd
Positive Technologies	PT-2026-33533	17 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-40485: Improper Restriction of Excessive Authentication Attempts	18 Apr 202600:00	–	rapid7
RedhatCVE	CVE-2026-40485	20 Apr 202619:23	–	redhatcve
Vulnrichment	CVE-2026-40485 ChurchCRM: Username Enumeration via Differential Response in Public Login API	17 Apr 202623:29	–	vulnrichment

Vulners

Node

churchcrm churchcrmRange<7.2.0

[
  {
    "vendor": "ChurchCRM",
    "product": "CRM",
    "versions": [
      {
        "version": "< 7.2.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ChurchCRM/CRM/security/advisories/GHSA-x2qh-xmhq-4jpx
github	www.github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850
github	www.github.com/ChurchCRM/CRM/pull/8607

Parameter	Position	Path	Description	CWE
username	request body	/api/public/user/login	Username enumeration via HTTP status code difference on the login endpoint.	CWE-204, CWE-307

17 Jun 2026 10:45Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.3

EPSS0.00397

SSVC