The flaw allows an authenticated user to be redirected to an arbitrary URL when clicking a cancel button on pages such as DonatedItemEditor.php. By manipulating the unsanitised linkBack parameter, an attacker can craft links that, when followed by a logged‑in user, send them to malicious or phishing destinations. While the vulnerability does not provide direct code execution or data theft, it increases the risk of credential theft or other social‑engineering attacks targeting church staff and members.

ChurchCRM, the open‑source church management system, is affected in all releases before version 7.0.0. The issue exists wherever the linkBack parameter is used, including the DonatedItemEditor component and similar pages.

The scoring indicates moderate severity. Exploitation requires an authenticated user session; the attacker merely supplies a malicious URL through the linkBack parameter, which is then executed when the user interacts with the cancel action. The attack is straightforward and could be leveraged in phishing campaigns against church staff or congregants.