A high-severity authorization bypass in ChurchCRM allows authenticated users to perform unauthorized modifications to family records, posing a significant risk to data integrity.

The application fails to perform proper role-based access control on several API endpoints, specifically those related to family verification, activation, and geocoding. An authenticated user can trigger these functions for arbitrary families by modifying the {familyId} parameter, bypassing intended privilege restrictions.

This vulnerability allows unauthorized users to modify sensitive records, which could lead to data corruption, unwanted administrative actions, and the mass distribution of verification emails to congregants. With a CVSS score of 8.1, the high impact on integrity and availability necessitates immediate attention to prevent operational disruption and loss of trust within the managed community.

Immediate Action: Update ChurchCRM to version 7.1.0 or later to apply the necessary authorization checks.

Proactive Monitoring: Review web server and application logs for suspicious patterns of API requests targeting the /family/ endpoint, particularly those involving unauthorized {familyId} values.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter API requests, specifically monitoring for unusual access patterns to the vulnerable /family/{familyId}/ paths.

Public Exploit Available: Unknown.

Given the ease with which this authorization bypass can be weaponized to manipulate critical database records, administrators must prioritize the upgrade to version 7.1.0. Failure to patch allows any authenticated user to circumvent core security controls, creating a substantial risk of unauthorized data modification.