ChurchCRM API Authentication Bypass (CVE-2026-39339)

Exploits CVE-2026-39339 in ChurchCRM 7.1.0: URL injection with ?bypass=/api/public on protected API routes bypasses AuthMiddleware and returns sensitive person/family records without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM API auth bypass via URL injection...