CVE-2026-40484
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-40484 is a critical-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-2 (Account Management) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40484 affects ChurchCRM, an open-source church management system, in versions prior to 7.2.0. The vulnerability resides in the database backup restore functionality, which extracts contents from an uploaded archive and uses the recursiveCopyDirectory() function to copy files from the Images/ directory into the web-accessible document root without any file extension filtering. This improper handling allows malicious files to be placed in executable locations.
An authenticated administrator can exploit this by uploading a crafted backup archive containing a PHP webshell within the Images/ directory, resulting in the webshell being written to a publicly accessible path and executable via HTTP requests, achieving remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling cross-site request forgery attacks that target an authenticated administrator to trigger the exploitation without their direct interaction. The CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects the high impact, with associated CWEs including 269 (Improper Privilege Management), 434 (Unrestricted Upload of File with Dangerous Type), and 552 (Files or Directories Accessible to External Parties).
The issue has been addressed in ChurchCRM version 7.2.0, as detailed in the project's GitHub security advisory (GHSA-2932-77f9-62fx), pull request #8610, and commit 68be1d12bc4cc1429575ae797ef05efe47030d39, which presumably introduce file filtering and CSRF protections to the restore functionality. Security practitioners should upgrade to 7.2.0 or later and review access to administrative restore features.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23597
Vulnerability Data
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension…
more
filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 5 OS baselines
V5.1.1V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly enforces authorization checks on access to files and directories, stopping unauthorized external exposure.
Account management directly governs assignment and tracking of privileges so proper implementation stops the weakness from being introduced.
Requiring explicit access-control decisions ensures privileges are evaluated rather than assumed or omitted.
Separation of duties constrains how privileges may be assigned, reducing the chance of overly broad actor control.
Least privilege is the direct countermeasure to improper privilege management; implementing it eliminates the root cause.
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-05 enforces least privilege/SoD and periodic reviews that directly remove most privilege-assignment defects, yet CWE-269 also covers escalation paths and role design outside a single access-management control.
PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.
Data-at-rest protections such as encryption or ACLs reduce the impact of unintended file exposure.
Logical segmentation and access protections stop external parties from reaching files that should remain internal.
Config baselines and default reviews can enforce some privilege-related settings (one facet) but do not address code-level assignment/tracking logic that defines CWE-269.
PR.PS-05 can partially limit exploitability of some privilege issues via execution restrictions, but does not address the core design/implementation flaws of CWE-269 at all.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By tracing and retrieving all copies of information stored on endpoint and portable devices, the control reduces the likelihood that files remain accessible outside the organization’s security perimeter.
Labeling information according to its sensitivity and specifying corresponding protection measures makes it less probable that files or directories containing sensitive content will be left accessible to external parties.
Explicit restrictions on privileged access and segregation of duties limit the scope of privileges that can be assigned, reducing the chance that excessive or unnecessary privileges are granted to entities.
Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.
Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.
Separating duties such as developing software from administering production systems prevents any one person from accumulating excessive privileges that would constitute improper privilege management.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248579 OL 8 must restrict access to the kernel message buffer. prevents CWE-552
- V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. prevents CWE-552
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-269
Windows Server 2016 (1 rule)
- V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. prevents CWE-269
Windows Server 2019 (1 rule)
- V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-269