CVE-2026-71239 Details

A vulnerability in the massmail module of DjangoCRM allows for template injection via user-controlled EmlMessage fields, specifically the subject and content. This issue arises because these fields are rendered using Django's Template() constructor without proper sanitization. The vulnerability is present in multiple files within the massmail module, including message_previews.py, email_creators.py, and helpers.py. An authenticated user with rights to edit mass-mail messages can inject Django template syntax, which is executed at render time. This could lead to the disclosure of sensitive information such as other users' data and password hashes through request context variables, CSRF token forgery, and the inclusion of arbitrary registered templates.