ChurchCRM Flaw: Data Deletion Via CSRF

The National Vulnerability Database (NVD) has detailed CVE-2026-40581, a high-severity vulnerability (CVSS 8.1) affecting ChurchCRM, an open-source church management system. Prior to version 7.2.0, the SelectDelete.php endpoint, responsible for family record deletion, allowed permanent and irreversible data removal through a simple GET request. Critically, this endpoint lacked any CSRF token validation.

This oversight means an attacker could craft a malicious webpage. If an authenticated administrator visits this page, the attacker can silently trigger the deletion of targeted family records. This includes associated notes, pledges, persons, and property data, all without any user interaction. The NVD highlights this as a critical data integrity risk, directly attributable to CWE-352 (Cross-Site Request Forgery) and CWE-862 (Missing Authorization).

For defenders, the implications are straightforward: unauthenticated users cannot directly exploit this, but an authenticated administrator is a single click away from devastating data loss. The NVD confirms the issue is resolved in ChurchCRM version 7.2.0. Organizations utilizing ChurchCRM must prioritize upgrading to mitigate this significant risk to their data integrity.