PT-2025-41335

CVE-2025-11529

Published

2025-10-09

Updated

2025-10-09

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.18.0

Description A security flaw exists in ChurchCRM impacting the AuthMiddleware function within the src/ChurchCRM/Slim/Middleware/AuthMiddleware.php file of the API Endpoint component. This allows for missing authentication and can be exploited remotely. The exploit has been publicly released.

Recommendations Apply the patch identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4.

Exploitability

Exploit

Fix

Impacts

Researchers

Uartu0

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

CWE-287: Improper Authentication