ChurchCRM CVE-2026-44548: High-Severity CSRF Allows Silent Record Deletion

The National Vulnerability Database (NVD) has detailed CVE-2026-44548, a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting ChurchCRM, an open-source church management system. Prior to version 7.3.2, this flaw allows an attacker to craft a malicious page that, when visited by a logged-in ChurchCRM user, silently triggers the deletion of critical records.

The vulnerability specifically targets FundRaiserDelete.php, PropertyTypeDelete.php, and NoteDelete.php. A user with the relevant role, simply by navigating from an attacker-controlled page, could inadvertently delete records. This includes not just the primary records but also any cascaded property and record-to-property assignments, leading to significant data loss without user interaction or consent. The NVD assigned a CVSS score of 8.1 (HIGH), underscoring the severity.

This isn’t just about deleting a single entry; the cascaded deletion means an attacker could wipe out entire categories of data, crippling administrative functions. The attacker’s calculus here is simple: leverage a user’s existing authenticated session to perform unauthorized actions. It’s a classic CSRF scenario, but the impact of silent, irreversible deletion is substantial for any organization relying on this system.