A missing object‑level authorization check on the GET /api/person/{personId} endpoint allows any authenticated user with basic EditSelf privileges to read any member’s record. The data returned contains names, addresses, phone numbers and e‑mail addresses, so the flaw results in a confidentiality breach of sensitive personal information. The underlying weakness is an IDOR (CWE‑639) coupled with improper authorization controls (CWE‑862).

ChurchCRM, an open‑source church management system, is affected in all releases older than version 7.2.0. The vulnerability exists across the CRM product family, as specified by the CNA vendor product list ChurchCRM:CRM. No specific patch level is listed in the CVE description for newer releases beyond 7.2.0, which includes the mitigation for this issue.

The CVSS score of 7.1 indicates a medium‑to‑high severity flaw. Because the flaw requires only authentication and a standard EditSelf role, it is trivially exploitable by any logged‑in user, making the risk high in environments lacking additional controls. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of defensive checks in the API layer makes the attack path straightforward: guess sequential person IDs and retrieve PII for each record without further authorization verification.