CVE-2025-11529

Katalog CVE

CVSS 9.8 · Critical EPSS 0,54%

Kerentanan Improper Authentication pada churchcrm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.

Rincian

Terbit di NVD

9 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4 patch
• https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md exploit · advisory pihak ketiga
• https://vuldb.com/?id.327667 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.669916 advisory pihak ketiga · vdb entry
• https://github.com/ChurchCRM/CRM/pull/7376 issue tracking
• https://vuldb.com/?ctiid.327667 permissions required · vdb entry