CVE-2023-26841

MEDIUM

ChurchCRM 4.5.3 - Cross-Site Request Forgery

Title source: llm

Description

A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26841

View Exploit ZIP pw:eip

Vendor Advisory

https://github.com/ChurchCRM/CRM

Scores

CVSS v3 6.5

EPSS 0.0042

EPSS Percentile 33.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (1)

churchcrm/churchcrm 4.5.3

Published Apr 25, 2023

Tracked Since Feb 18, 2026