CVE-2025-11529: churchcrm before 5.19.0 (exclusive); +1 more affected products

Affected technology

churchcrm · before 5.19.0 (exclusive)
churchcrm

ChurchCRM · 5.0, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 5.9, 5.10, 5.11, 5.12, 5.13, 5.14, 5.15, 5.16, 5.17, 5.18.0
Vendor not specified by the source

Description’s affected range: up to 5.18.0

Component: API Endpoint
Function: AuthMiddleware
File: src/ChurchCRM/Slim/Middleware/AuthMiddleware.php

Attack conditions (VulDB, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 5.5/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.