CVE-2026-71240 Details
Description
DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view.
A vulnerability in DjangoCRM's toggle_default_sorting view allows for unauthenticated phishing redirects and referrer-based token leakage. This issue arises because the view is not protected by login or staff member requirements, and it redirects based on a caller-supplied next_url GET parameter. The vulnerability is present in DjangoCRM versions compatible with Django 6.0+, Python 3.12+, MySQL 8.0.11+, and PostgreSQL 14+. The issue stems from the view's reliance on secure_url(next_url), which only verifies that the target host matches the current site's domain, allowing any same-site path to be used in the redirect without authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DjangoCRM/django-crm | TuranSec | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| DjangoCRM | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |