CVE-2026-71240 in django-crm
Summary
by MITRE • 08/05/2026
DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view. This enables unauthenticated phishing redirects and referrer-based token leakage via redirect chains.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists in DjangoCRM's toggle_default_sorting view which represents a critical authorization flaw in the application's access control mechanisms. The issue stems from the absence of proper authentication checks on what should be a protected administrative function, as evidenced by the fact that this single route in common/urls.py lacks the standard login_required or staff_member_required decorators that protect other similar endpoints. The vulnerability manifests through the insecure handling of the next_url GET parameter which undergoes only basic domain validation through secure_url() function rather than comprehensive authentication verification.
The technical implementation flaw allows attackers to exploit a redirect chain vulnerability where an attacker can craft malicious URLs that bypass authentication entirely by leveraging the insecure redirect mechanism. The secure_url(next_url) function provides minimal protection by only validating that the target host matches the current site's domain, effectively creating a cross-domain blocking mechanism but failing to prevent same-site path traversal attacks. This validation does not enforce any user authentication or authorization checks before allowing access to the vulnerable endpoint, making it trivial for unauthenticated users to manipulate the redirect behavior.
The operational impact of this vulnerability is significant as it enables unauthenticated phishing redirects that can be used to deceive users into visiting malicious sites while appearing to come from legitimate sources within the same domain. Attackers can construct redirect chains that exploit the lack of authentication requirements to perform referrer-based token leakage, where sensitive information might be transmitted through HTTP referer headers during the redirect process. This creates a vector for credential theft and session hijacking attacks, particularly when users are navigating between different sections of the application or when the redirect targets other authenticated endpoints.
This vulnerability aligns with CWE-352 (Cross-Site Request Forgery) and CWE-614 (Sensitive Cookie in HTTPS Only) categories, representing a failure in proper access control implementation and session management. The flaw also maps to ATT&CK technique T1566 (Phishing) and T1531 (Account Access Removal) as it enables attackers to manipulate user sessions and redirect them to malicious sites. The lack of authentication checks on this administrative function creates an attack surface that can be exploited for privilege escalation and unauthorized access to sensitive CRM functionalities.
The recommended mitigation strategy involves implementing proper authentication decorators on the toggle_default_sorting view to ensure only authenticated users can access it, along with strengthening the redirect validation mechanism to include comprehensive URL sanitization and authentication verification. Additionally, the secure_url() function should be enhanced to validate not just domain matching but also enforce proper authorization checks before allowing redirects to proceed. Organizations should implement strict input validation on all user-supplied parameters and ensure that any redirect functionality requires explicit authentication and authorization verification before executing any redirection logic.