A low‑privileged user can trigger the /CSVCreateFile.php POST endpoint to receive a CSV that contains all Personally Identifiable Information of every member and family record. The script performs only a coarse “has any admin legacy bootstrap” check and lacks a dedicated isAdmin or export‑data permission validation, allowing any authenticated user with any granted permission flag to access it. The vulnerability therefore permits an attacker to exfiltrate names, addresses, contact details, and other sensitive member information without possessing administrative rights.

ChurchCRM (CRM) installations that are using any version before 7.4.0 and have retained the legacy CSVCreateFile.php endpoint are affected. The flaw is present in deployments where the endpoint is reachable for authenticated non‑admin users.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been reported. Exploitation requires only an authenticated account with any permission flag and involves sending a simple HTTP POST request to /CSVCreateFile.php; no additional privileges or exotic conditions are required.