CVE-2026-71238

Name of the Vulnerable Software and Affected Versions DjangoCRM (affected versions not specified)

Description The software contains a hardcoded SECRET KEY within the webcrm/settings.py file instead of retrieving it from an environment variable. This key is critical for session signing, CSRF token generation, and password reset tokens. An attacker with access to the public repository can use this key to forge valid session cookies, including those for the superadmin account, as well as forge CSRF and password reset tokens, leading to full account takeover. Additionally, the default configuration has DEBUG set to True, which allows error pages to leak sensitive information such as database credentials, email credentials, OAuth data, and internal file paths.

Recommendations Change the hardcoded SECRET KEY in webcrm/settings.py to a unique, random value and configure the application to read it from an environment variable. Set the DEBUG variable to False in the production configuration to prevent the leakage of sensitive system information.