The public login API endpoint returns distinct status codes: a 404 when a username does not exist and a 401 when the username exists but the password is wrong. This differential response allows an unauthenticated attacker to systematically discover valid usernames by observing the returned HTTP code, effectively leaking sensitive account information. Although this vulnerability does not grant direct access or administrative privileges, it expands the attack surface and can facilitate targeted credential‑guessing or social‑engineering attacks once valid usernames are known. The weakness reflects an Information Exposure flaw (CWE‑204) and improper handling of authentication responses (CWE‑307).

ChurchCRM:CRM, all releases earlier than version 7.2.0. The public API endpoint /api/public/user/login is affected; later releases have been patched.

The CVSS score of 5.3 places this issue in the medium severity range. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation at the time of this report. However, the public nature of the endpoint, lack of rate limiting, and absence of account lockout mechanisms mean that an attacker can enumerate usernames efficiently by sending numerous requests from any remote host. The attack vector is remote over the internet, requiring only network connectivity to the CRM server and no prior credentials.