# CVE-2026-39339: CRM - Authentication Bypass

> Live exploitation tracking for CVE-2026-39339 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-39339

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.1
- **Public exploit available:** Yes
- **Affected products:** ChurchCRM CRM
- **Weaknesses:** CWE-284 (Improper Access Control)
- **Tags:** cms

## Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, a  critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.

## CrowdSec analysis

[CVE-2026-39339](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-39339) is a critical authentication bypass vulnerability in ChurchCRM prior to version 7.1.0, affecting its API middleware. By manipulating the request URL to include "api/public," unauthenticated attackers can gain unrestricted access to all protected API endpoints, potentially exposing sensitive church member data and system information. This flaw poses a significant risk of data breaches and unauthorized data disclosure.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2026-39339 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-39339 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by sending crafted requests to API endpoints such as `/api/persons/latest` with a `bypass=/api/public` query parameter, allowing unauthenticated access to protected ChurchCRM API resources.

## Timeline

- 2026-04-07: CVE Published. CVE-2026-39339 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2026-39339 exploitation attempts against the CrowdSec Network.
- 2026-05-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-39339 for the first time.

## References

- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39339.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-39339) follows observed exploitation activity for CVE-2026-39339. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.