CVE-2026-39339

CVE-2026-39339 is a critical authentication bypass vulnerability affecting ChurchCRM versions prior to 7.1.0. The flaw exists in the API middleware authentication handler, allowing unauthenticated attackers to access all protected API endpoints by simply including "api/public" in the request URL. This vulnerability exposes sensitive church member data and system configuration information to unauthorized access. The vulnerability has a CVSS severity rating of 9.1 (CRITICAL) with a network-based attack vector requiring no user interaction or special privileges. The attack is trivial to execute with low complexity, and the potential impact includes complete compromise of data confidentiality and integrity, though system availability is not affected. CVE-2026-39339 is not currently tracked on the Known Exploited Vulnerabilities (KEV) catalog, and no publicly available exploit code has been reported. The vulnerability remains on the inactive Hot List, suggesting minimal active exploitation or community attention at this time. Organizations running ChurchCRM should prioritize upgrading to version 7.1.0 or later to remediate this critical authentication bypass.