CVE-2026-71240

Name of the Vulnerable Software and Affected Versions DjangoCRM (affected versions not specified)

Description The toggle default sorting view in common/urls.py lacks authentication wrappers such as login required or staff member required. The view redirects to a destination specified by the next url GET parameter after validating it with the secure url() function. However, this function only verifies that the target host matches the current site domain, failing to prevent redirects to any internal path. This flaw allows unauthenticated users to perform phishing redirects and cause referrer-based token leakage through redirect chains.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.