https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:58:53 +0000 https://cve.radiocsirt.org/vuln/cve-2026-40582 <p><strong>Affected:</strong> ChurchCRM CRM</p> <p>ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user&#39;s API key, bypassing the normal authentication flow that enforces account lockout and two-factor authentication checks. An attacker with knowledge of a user&#39;s password can obtain API access even when the account is locked or has 2FA enabled, granting direct access to all protected API endpoints with that user&#39;s privileges. This issue has been fixed in version 7.2.0. Note: this issue had a duplicate, GHSA-472m-p3gf-46xp, which has been closed.</p> <p><strong>Affected:</strong> ChurchCRM CRM</p> <p>ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user&#39;s API key, bypassing the normal authentication flow that enforces account lockout and two-factor authentication checks. An attacker with knowledge of a user&#39;s password can obtain API access even when the account is locked or has 2FA enabled, granting direct access to all protected API endpoints with that user&#39;s privileges. This issue has been fixed in version 7.2.0. Note: this issue had a duplicate, GHSA-472m-p3gf-46xp, which has been closed.</p> https://cve.radiocsirt.org/vuln/cve-2026-40582