A missing CSRF token in ChurchCRM's UserEditor.php allows an unauthenticated attacker to craft a malicious page that, when visited by an authenticated administrator, silently elevates a low‑privilege user to a full administrator or creates a new backdoor admin account. The result is full control over the system, compromising confidentiality, integrity and availability. The weakness is a classic privilege‑management flaw (CWE‑269) compounded by improper authentication and missing CSRF protection (CWE‑306 and CWE‑352).

ChurchCRM product, all releases prior to version 7.3.2 obtained from the ChurchCRM project repository. The vulnerability resides in the UserEditor.php component responsible for user creation and permission updates.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTML page that triggers a CSRF request using the victim's authenticated session cookie; no local access or code execution is required. The attacker cannot log in or exploit other weaknesses—only a convenience of the web application’s missing CSRF token. Due to the nature of CSRF, the exploitation risk is moderate but significant for environments with widely‑distributed administrators.