ChurchCRM’s family‑scoped endpoints mistakenly accept a client supplied familyId without verifying that the requested family belongs to the authenticated user, allowing a low‑privileged user to see and alter any family’s data. This flaw bypasses the intended EditSelf scope and breaks confidentiality and integrity of congregation records. The attack adds or modifies data that the user should not be able to touch, potentially compromising sensitive family information.

ChurchCRM, the open‑source church management system, is vulnerable in every release older than version 7.4.0. Non‑administrative users granted EditSelf permission, and optionally Notes permission, can exploit the issue. The backend loads the target family by ID without checking the current user's association with that family.

The CVSS score of 7.1 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an authenticated API request that manipulates the familyId parameter to access records outside the user’s own family scope. Such exploitation requires only legitimate user credentials and the relevant permissions, making it straightforward for an authorized user to read or alter unrelated family records and insert notes.