DjangoCRM Vulnerability Allows Unauthenticated Redirection

CVE-2026-71240

What is CVE-2026-71240?

The vulnerability in DjangoCRM's toggle_default_sorting view arises from a lack of proper access control. This specific route is not secured by login or staff member requirements, allowing unauthorized users to access it. The redirect mechanism merely checks that the target URL belongs to the same domain, but does not authenticate the user. Consequently, this could lead to phishing attacks as malicious actors can construct redirect chains that leverage this vulnerability, resulting in potential exposure of sensitive tokens through referrer leakage.

References