CRM - Authentication Bypass (CVE-2026-39339)

CVE-2026-39339 is a critical authentication bypass vulnerability in ChurchCRM prior to version 7.1.0, affecting its API middleware. By manipulating the request URL to include "api/public," unauthenticated attackers can gain unrestricted access to all protected API endpoints, potentially exposing sensitive church member data and system information. This flaw poses a significant risk of data breaches and unauthorized data disclosure.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2026-39339 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-39339 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by sending crafted requests to API endpoints such as /api/persons/latest with a bypass=/api/public query parameter, allowing unauthenticated access to protected ChurchCRM API resources.