CVE-2026-71240: DjangoCRM Auth Bypass Vulnerability

CVE-2026-71240 Overview

CVE-2026-71240 is an open redirect vulnerability in DjangoCRM's toggle_default_sorting view. The view is the only route in common/urls.py that is not protected by login_required or staff_member_required decorators. It redirects to a caller-supplied next_url GET parameter after checking only that the target host matches the current site's domain. This same-site restriction blocks cross-domain redirects but permits arbitrary same-site paths without authentication. Attackers can abuse the endpoint for phishing redirect chains and referrer-based token leakage. The weakness is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Unauthenticated attackers can craft URLs that redirect victims through a trusted DjangoCRM host, enabling phishing and leaking sensitive tokens via the HTTP Referer header.

Affected Products

DjangoCRM (open-source Django CRM application)
Deployments exposing the common/urls.pytoggle_default_sorting route
Instances relying on secure_url() as the sole redirect guard

Discovery Timeline

2026-08-05 - CVE-2026-71240 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71240

Vulnerability Analysis

The toggle_default_sorting view accepts a next_url query parameter and issues an HTTP redirect after validating the value with a helper named secure_url(). That helper compares only the hostname of next_url against the current site's domain. It rejects fully qualified URLs pointing at attacker-controlled hosts but accepts any same-site path, including paths that themselves redirect elsewhere. Every other route in common/urls.py is wrapped in login_required or staff_member_required, so this endpoint is uniquely reachable without a session. An unauthenticated attacker can therefore invoke it directly.

Root Cause

The root cause is a combination of missing authentication and insufficient redirect validation. The view lacks the access-control decorators applied elsewhere in the module. The secure_url() function performs a host-match check but does not validate the destination path against an allowlist, does not reject open-redirect gadgets already present on the site, and does not enforce authenticated context before honoring the parameter.

Attack Vector

Exploitation requires only that a victim click a crafted link. The attacker builds a URL such as https://victim-crm.example.com/common/toggle-default-sorting/?next_url=/path/that/redirects/offsite, chaining through a same-site path that itself performs a redirect to an external phishing page. Because the initial hop originates from the trusted CRM domain, the browser attaches the CRM origin in the Referer header sent to downstream destinations. Tokens embedded in query strings or path segments during the redirect chain can leak to attacker-controlled endpoints. See the DjangoCRM GitHub repository for source references to common/urls.py and the secure_url helper.

Detection Methods for CVE-2026-71240

Indicators of Compromise

Unauthenticated HTTP requests to the toggle_default_sorting endpoint containing a next_url parameter
Redirect chains originating from the DjangoCRM host that terminate on external, low-reputation domains
Spikes in HTTP 302 responses from common/ routes without an associated authenticated session cookie

Detection Strategies

Parse web server access logs for requests to toggle_default_sorting where the next_url value contains encoded slashes, protocol-relative prefixes, or nested redirect handlers
Correlate anonymous sessions hitting the endpoint with subsequent outbound redirects to domains outside the organization's allowlist
Baseline typical next_url values used by legitimate CRM navigation and alert on outliers

Monitoring Recommendations

Enable verbose logging of Django HttpResponseRedirect targets returned by common views
Monitor upstream proxy or WAF logs for Referer headers pointing at the CRM host followed by unusual external navigation
Track user reports of unexpected redirects after clicking CRM-branded links in email

How to Mitigate CVE-2026-71240

Immediate Actions Required

Wrap the toggle_default_sorting view in login_required and, where appropriate, staff_member_required decorators to align it with the rest of common/urls.py
Replace the host-only check in secure_url() with an allowlist of known-safe internal paths
Strip or ignore the next_url parameter for unauthenticated requests until a fix is deployed

Patch Information

No vendor advisory URL was published in the NVD record at the time of writing. Track the DjangoCRM GitHub repository for commits that add authentication decorators to toggle_default_sorting and tighten secure_url() validation.

Workarounds

Deploy a reverse-proxy or WAF rule that blocks anonymous requests to /common/toggle-default-sorting/ carrying a next_url parameter
Set Referrer-Policy: no-referrer or same-origin at the application layer to reduce token leakage through redirect chains
Remove the route from common/urls.py if the sorting-toggle feature is not required in the deployment

bash

# Example nginx rule to block unauthenticated exploitation attempts
location = /common/toggle-default-sorting/ {
    if ($cookie_sessionid = "") {
        return 403;
    }
    proxy_pass http://djangocrm_upstream;
}