High severity7.3NVD Advisory· Published Oct 9, 2025· Updated Apr 29, 2026
CVE-2025-11529
CVE-2025-11529
Description
A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.
Affected products
1Patches
2c448502da09b3a1cffd2aea6Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4nvdPatch
- github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.mdnvdExploitThird Party Advisory
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdThird Party AdvisoryVDB Entry
- github.com/ChurchCRM/CRM/pull/7376nvdIssue Tracking
- vuldb.comnvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.