A critical authentication bypass vulnerability in ChurchCRM allows unauthenticated attackers to access sensitive API endpoints, posing a severe risk of unauthorized data exposure and system manipulation.

The vulnerability exists within the AuthMiddleware component located in src/ChurchCRM/Slim/Middleware/AuthMiddleware.php. The application incorrectly performs string matching against the full request URI rather than the request path, allowing an unauthenticated attacker to bypass authentication by including the substring "api/public" anywhere in the request URI.

The ability for an unauthenticated attacker to bypass authentication and interact with protected API endpoints creates a significant risk of unauthorized data exfiltration, including sensitive member information. Given the CVSS score of 7.3 and the nature of the flaw, this vulnerability could facilitate complete unauthorized access to administrative functions, leading to significant reputational damage and potential loss of data integrity within the CRM system.

Immediate Action: Update ChurchCRM to version 5.18.1 or later, where the authentication middleware logic has been corrected to properly validate request paths.

Proactive Monitoring: Review web server and application access logs for suspicious requests containing the "api/public" string in unusual positions or query parameters, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing anomalous URI patterns or unauthorized attempts to access protected API endpoints from external sources.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up by uartu0.

This vulnerability represents a significant security oversight that exposes the core of the ChurchCRM platform to unauthorized access. Organizations currently running versions up to 5.18.0 must prioritize applying the provided patch immediately. Failure to update leaves the system susceptible to trivial, unauthenticated exploitation that could compromise the confidentiality and integrity of all stored CRM data.