CVE-2026-39327
Published: 07 April 2026
Summary
CVE-2026-39327 is a high-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-39327 is an SQL injection vulnerability (CWE-89) affecting ChurchCRM, an open-source church management system. The issue resides in the /MemberRoleChange.php endpoint in versions prior to 7.1.0, such as 7.0.5, where the NewRole parameter fails to properly sanitize input. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with low complexity and privileges.
Authenticated users with the Manage Groups & Roles (ManageGroups) permission can exploit this vulnerability by injecting arbitrary SQL statements through the NewRole parameter. Successful exploitation allows attackers to extract sensitive data from the database or modify records, potentially compromising the confidentiality, integrity, and availability of church management information.
The ChurchCRM security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66fc-v5xj-x859 confirms the vulnerability and states that it is fixed in version 7.1.0. Security practitioners should upgrade to 7.1.0 or later and review access to the ManageGroups role to mitigate risks.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19822
Vulnerability details
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /MemberRoleChange.php in ChurchCRM 7.0.5. Authenticated users with the role Manage Groups & Roles (ManageGroups) can inject arbitrary SQL statements through the…
more
NewRole parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing web app endpoint directly enables T1190 Exploit Public-Facing Application for remote data access/modification.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates validation of the NewRole parameter to block SQL injection attempts in the /MemberRoleChange.php endpoint.
Requires timely identification and patching of the SQL injection flaw by upgrading to ChurchCRM 7.1.0 or later.
Enforces least privilege on the ManageGroups role to minimize users able to access and exploit the vulnerable endpoint.