CVE-2025-66397 — ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control
ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions in the Kiosk Manager f…
Published: 2025-12-17 · CVSS: 8.3 · CVSS 3.1
ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions in the Kiosk Manager feature suffers from broken access control, allowing any authenticated user to allow and accept kiosk registrations, and perform other Kiosk Manager actions such as reload and identify. Version 6.5.3 fixes the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7