Cyber Resilience

CVE-2026-42289

High

Published: 12 May 2026

Published
12 May 2026
Modified
14 May 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0013 2.8th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-42289 is a high-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by…

more

an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1136 Create Account Persistence
Adversaries may create an account to maintain access to victim systems.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CSRF in public-facing web app directly enables unauthorized account creation and privilege escalation (admin backdoor).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-13618Shared CWE-269
CVE-2026-22238Shared CWE-269, CWE-306
CVE-2025-6994Shared CWE-269
CVE-2026-46824Shared CWE-269, CWE-306
CVE-2025-68434Shared CWE-352
CVE-2024-57602Shared CWE-269
CVE-2025-22937Shared CWE-269
CVE-2026-26055Shared CWE-306
CVE-2025-8900Shared CWE-269
CVE-2026-26725Shared CWE-269

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-306 CWE-269

Guarantees critical functions are protected by mandatory invocation of the access control mechanism.

addresses: CWE-306 CWE-269

Certification assesses that critical functions have required authentication controls in place.

addresses: CWE-306 CWE-352

Re-authentication enforces fresh credential validation for critical functions or operations as defined by the organization parameter.

addresses: CWE-269 CWE-306

Baseline tailoring enforces organization-specific privilege-management decisions rather than accepting generic high-water-mark settings.

addresses: CWE-269 CWE-306

Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.

addresses: CWE-269 CWE-306

By determining which components are critical, the analysis drives proper privilege assignment and management for those components, limiting attacker escalation paths.

addresses: CWE-269 CWE-306

Developer training on implemented privilege management controls prevents improper assignment or escalation through correct configuration and operation.

addresses: CWE-269 CWE-306

Least-privilege and separation-of-duties principles prevent improper privilege management.

References