CVE-2026-35184 is a critical SQL injection flaw in EcclesiaCRM, the church management CRM, scored 9.8 in the CVE record. It sits in the query view page and is reachable through the custom and value parameters. The record says the issue is fixed in 8.0.0, so upgrade to that release or later.
What's affected
- Product: EcclesiaCRM (phili67/ecclesiacrm)
- Affected versions: before 8.0.0 (the GitHub advisory lists "less than 8.0")
- Fixed version: 8.0.0, per the CVE record
- Vulnerable file:
src/v2/templates/query/queryview.php - Vulnerable parameters:
customandvalue
The GitHub advisory describes the impact as authentication bypass and full database access. It also says the issue applies only when an administrator has granted access rights to database queries. The advisory page shows no patched version field, so confirm the release on the project's page before you rely on it. The fix is in pull request 2861.
The record does not say this flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find out which version you run. The version is shown inside the application, and the release you deployed is the source of truth if you installed from a tagged build.
To locate the vulnerable template on a server:
find / -path "*templates/query/queryview.php" 2>/dev/null
If the file exists and your version is older than 8.0.0, you are in the affected range. Then check who holds the permission to run database queries in the application. The advisory says that permission is the condition for exposure, so a small list of holders is a smaller risk, though not zero.
What to do now
- Upgrade EcclesiaCRM to 8.0.0 or later and confirm the version afterwards.
- Until you can upgrade, do not grant the database query permission to anyone. Review who already has it and remove it where it is not needed.
- If the CRM is reachable from the internet, restrict access to a VPN or a list of known addresses while you patch.
- Review web server and database logs for unusual requests to the query pages.
- Because the data is member and donor information, decide whether your obligations call for a review of what was exposed.
Why it matters
SQL injection means request input becomes part of a database command. The record files this under CWE-89. When a page joins request values into SQL text, whoever controls the value can change what the database is asked to do, and the advisory describes that as full database access here.
A church CRM holds names, addresses, family links and giving records. A flaw that exposes the whole database is serious even for a small installation. The fix is the upgrade, and the workaround is a permission you can switch off today.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need the query permission turned on to be at risk?
The advisory says the flaw applies only when an administrator grants access rights to database queries. If nobody has that right on your instance, the advisory workaround is already in place, but you should still upgrade.
Does a dependency scan find this?
No. The flaw is in the application code, not in a library. A scan of the packages around the app still helps, and the Gold free scan covers those.
Sources
Last reviewed: 19 October 2026.
