CVE-2026-39334
Published: 07 April 2026
Summary
CVE-2026-39334 is a high-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-39334 is an SQL injection vulnerability (CWE-89) affecting ChurchCRM, an open-source church management system, in versions prior to 7.1.0, with the issue specifically identified in version 7.0.5. The flaw resides in the /SettingsIndividual.php endpoint, where authenticated users without specific privileges can inject arbitrary SQL statements through the "type" array parameter via the "index" parameter, potentially compromising the underlying database.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N), earning it a CVSS v3.1 base score of 8.8 (High). Successful exploitation enables high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), allowing attackers to extract sensitive data or modify database contents.
The vulnerability is addressed in ChurchCRM 7.1.0. Organizations should upgrade to this version or later to mitigate the issue, as detailed in the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8g53-72jr-39w6.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19831
Vulnerability details
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsIndividual.php in ChurchCRM 7.0.5. Authenticated users without any specific privileges can inject arbitrary SQL statements through the type array parameter via…
more
the index and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the ChurchCRM web application endpoint (/SettingsIndividual.php) allows remote exploitation by authenticated users, directly matching T1190: Exploit Public-Facing Application. The high-impact DB compromise (data extraction/modification) is a direct result of this exploitation technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection attacks by requiring validation of untrusted inputs like the 'type' array parameter in the /SettingsIndividual.php endpoint.
Ensures timely remediation of the specific SQL injection flaw by patching to ChurchCRM 7.1.0 or later, eliminating the vulnerability.
Enforces least privilege for authenticated users, limiting the scope of database access and damage potential even if low-privilege users reach the vulnerable endpoint.