ChurchCRM, an open‑source church management application, contains an authorization bypass that allows any authenticated API user to alter family records without proper privilege. Prior to version 7.1.0, a user can change the familyId parameter in various endpoints—such as /family/{familyId}/verify, /verify/url, /verify/now, /activate/{status}, and /geocode—to deactivate or reactivate families, trigger spam verification emails, or mark families as verified, thereby affecting data integrity and potentially exposing sensitive information. The weakness is a classic privilege escalation flaw (CWE-639) compounded by improper validation of user‑controlled identifiers (CWE-863).

The affected product is ChurchCRM version 7.0 and earlier. Version 7.1.0 and later contain a fix that restores proper role‑based access control for all listed endpoints. The recommendation is to upgrade to the latest release or apply the vendor’s patch if available.

The CVSS score of 8.1 indicates a high severity. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need a valid authenticated session and knowledge of the familyId values; no public exploit code is known, but the absence of strict access checks makes the attack relatively straightforward once a target is identified.