CVE-2025-11529

High

Description

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.

SeverityHigh

CVSS7.3

Exploit probability—

ProductChurchcrm

PublishedOct 9, 2025

First seenOct 9, 2025

Weakness typeCWE-306Missing authentication for critical function CWE-287Improper authentication

How to fix

Update

churchcrm churchcrm5.19.0 or later

Patches

github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4

Affected products

Product	Affected versions	Fixed in
churchcrm churchcrm	v < 5.19.0	5.19.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.