The vulnerability resides in the /api/public/user/login endpoint, which validates only a username and password before issuing an API key. The normal authentication flow that enforces account lockout and two‑factor authentication is bypassed. If an attacker knows a user’s password, they can obtain an API key even when the account is locked or 2FA is required, thereby gaining direct access to all protected API endpoints with the victim’s privileges.

ChurchCRM CRM installations running any version earlier than 7.2.0 are affected. The issue was fixed in 7.2.0 and later versions are not vulnerable.

With a CVSS score of 9.1, the vulnerability poses a high severity risk. Exploitation requires only knowledge of a user’s password and does not rely on other privileges. The likely attack vector is simple credential misuse over the exposed API endpoint. The EPSS score is not available, and it is not listed in CISA KEV, but the impact of bypassing authentication controls presents a severe threat to confidentiality and integrity of all API data.