High severity7.3NVD Advisory· Published Oct 9, 2025· Updated Apr 29, 2026

CVE-2025-11529

Description

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Churchcrm/Churchcrm2 versions
cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*range: <5.19.0
- (no CPE)range: <=5.18.0

Patches

Vulnerability mechanics

References

github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4nvdPatch
github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.mdnvdExploitThird Party Advisory
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
github.com/ChurchCRM/CRM/pull/7376nvdIssue Tracking
vuldb.comnvdPermissions RequiredVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000