CVE-2025-11529: High API Authentication Bypass in ChurchCRM

CVE-2025-11529 is a high severity (CVSS 7.3) missing authentication flaw in ChurchCRM up to version 5.18.0, in the AuthMiddleware that guards the API. The fix is merged upstream in commit 3a1cffd. Upgrade to a current release, and confirm the release you choose contains that commit.

What's affected

• Product: ChurchCRM, the open source church management application
• Affected: versions up to and including 5.18.0
• Component: the API endpoint authentication middleware, in src/ChurchCRM/Slim/Middleware/AuthMiddleware.php
• Fix: pull request 7376, merge commit 3a1cffd2aea63d884025949cfbcfd274d06216a4, merged on 4 October 2025 according to the pull request page
• Released versions: a researcher write up says patched versions are 5.18.1 and later and tells readers to confirm the release tag. Treat that as a pointer, and check the ChurchCRM releases page yourself

The weaknesses are CWE-306 (missing authentication for a critical function) and CWE-287 (improper authentication). The CVSS vector needs no account, no user interaction and a network connection. Impacts are rated low for confidentiality, integrity and availability, which is how the 7.3 score arises.

How to check if you're exposed

Find the version first. ChurchCRM runs as a PHP application on your own server, so look at the release you deployed and its changelog.

cd /path/to/churchcrm
grep -n "class AuthMiddleware" src/ChurchCRM/Slim/Middleware/AuthMiddleware.php
git log --oneline -n 5 2>/dev/null

If you installed from a release archive, compare your version with 5.18.0. Anything at or below it is in range. If you track the git repository, check whether commit 3a1cffd is in your history.

git branch --contains 3a1cffd2aea63d884025949cfbcfd274d06216a4

Also review your reverse proxy or web server logs for API requests that came from unexpected addresses or without a session, particularly requests to person and family data endpoints. Unusual query strings on API paths are worth a look.

What to do now

1. Upgrade ChurchCRM to a current release. GitHub lists later versions than 5.18.x, so read the release notes and back up the database and the configuration and image folders first.
2. After upgrading, confirm the fix is present by checking that the middleware change from pull request 7376 is in your code.
3. If you cannot upgrade immediately, limit access to the application to trusted networks or a VPN. A church directory holds personal details, so keep it off the open internet where you can.
4. Review API access logs for the period since your last upgrade. Look for access to member data from addresses you do not recognise.
5. Rotate API keys and admin passwords if logs show anything unexplained, and tell the people responsible for data protection in your organisation.
6. Subscribe to the project's security advisories so the next fix reaches you quickly.

Why it matters

The upstream pull request describes a bypass in the API where a query parameter allowed the security check to be skipped. The researcher write up gives the root cause in one line: the check compared a string against the full request URI instead of the request path. In plain terms, the code decided whether a request was public by looking at text the requester can influence.

That is a common design error in authentication filters. Allow lists must match what the router will actually run, not a substring anywhere in the request. The fix is a change to AuthMiddleware.php plus a test in the project's Cypress suite for private API authentication.

The data at stake is also worth naming. A church management system typically stores names, contact details, family relationships and giving records. The record is not in the CISA Known Exploited Vulnerabilities catalog, and no source we fetched reports attacks. The record does say the exploit is public, which makes it a strong candidate for opportunistic scanning of unpatched installs.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• ChurchCRM pull request 7376, Fix API Authentication Bypass
• Fix commit 3a1cffd
• Researcher advisory write up

Last reviewed: 19 October 2026.