ChurchCRM, an open‑source church management application, contains an open redirect flaw in multiple pages, including DonatedItemEditor.php. An authenticated user can be redirected to an attacker‑chosen URL when they click a Cancel button that passes the linkBack parameter. This flaw allows malicious actors to deliver phishing pages or other malicious content to trusted users via a straightforward web‑based interaction. The weakness is a classic open redirect (CWE‑601).

All ChurchCRM installations prior to version 7.0.0 are affected, as the flaw exists wherever the linkBack parameter is used. The affected product is the ChurchCRM CRM application, and any instance that has not been updated to 7.0.0 or later remains vulnerable.

The CVSS score of 5.3 indicates moderate risk. An attacker only needs to be authenticated within the application to exploit the redirect; no local enumeration or privilege escalation is required. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a web‑based user clicking a crafted link that manipulates the linkBack parameter.