CVE-2026-71240: DjangoCRM: Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurl(nexturl), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view. This enables unauthenticated phishing redirects and referrer-based token leakage via redirect chains.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71240?
The severity of CVE-2026-71240 is medium with a score of 5.4.
What type of vulnerability is CVE-2026-71240?
CVE-2026-71240 is an unauthenticated open redirect vulnerability in DjangoCRM.
How do I fix CVE-2026-71240?
To fix CVE-2026-71240, ensure that the toggle_default_sorting view is wrapped with login_required or staff_member_required decorators.
What software is affected by CVE-2026-71240?
CVE-2026-71240 affects the DjangoCRM software.
What does the vulnerability CVE-2026-71240 allow attackers to do?
CVE-2026-71240 allows attackers to exploit unauthenticated users by redirecting them to a malicious next_url parameter.