CVE-2025-11529
criticalA security flaw has been discovered in ChurchCRM up to 5.18.0.
Vendor / product: Churchcrm — churchcrm
A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-10-09 03:15
Modified: 2026-10-19 16:10
NVD status: Modified
Last synced 3 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
churchcrm / churchcrm <5.19.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4
References
- https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 cna@vuldb.com
- https://github.com/ChurchCRM/CRM/pull/7376 cna@vuldb.com
- https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md cna@vuldb.com
- https://vuldb.com/?ctiid.327667 cna@vuldb.com
- https://vuldb.com/?id.327667 cna@vuldb.com
- https://vuldb.com/?submit.669916 cna@vuldb.com
- https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗