CVE-2026-71240

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71240", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T10:53:53.175Z", "datePublished": "2026-08-05T10:56:39.721Z", "dateUpdated": "2026-08-10T11:45:46.461Z"}, "containers": {"cna": {"title": "DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter", "descriptions": [{"lang": "en", "value": "DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-601 URL Redirection to Untrusted Site", "cweId": "CWE-601", "type": "CWE"}]}], "affected": [{"vendor": "DjangoCRM", "product": "django-crm", "programFiles": ["common/views/toggle_default_sorting.py", "common/utils/secure_url.py"], "versions": [{"version": "0", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "references": [{"url": "https://github.com/DjangoCRM/django-crm", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Mirdavlatov Mira'zam", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:46.461Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T10:56:39.721Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T12:57:34.698525Z", "id": "CVE-2026-71240", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:57:46.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T12:57:34.698525Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:57:38.175Z"}}], "cna": {"title": "DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mirdavlatov Mira'zam"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "DjangoCRM", "product": "django-crm", "versions": [{"status": "affected", "version": "0"}], "programFiles": ["common/views/toggle_default_sorting.py", "common/utils/secure_url.py"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T10:56:39.721Z", "references": [{"url": "https://github.com/DjangoCRM/django-crm", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view.", "supportingMedia": [{"type": "text/html", "value": "<p>DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:46.461Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71240", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:45:46.461Z", "dateReserved": "2026-08-05T10:53:53.175Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T10:56:39.721Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "django-crm", "programFiles": ["common/views/toggle_default_sorting.py", "common/utils/secure_url.py"], "vendor": "DjangoCRM", "versions": [{"status": "affected", "version": "0"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view."}, {"lang": "es", "value": "La vista \u201ctoggle_default_sorting\u201d de DjangoCRM es la \u00fanica ruta en common/urls.py que no est\u00e1 envuelta en \u201clogin_required\u201d o \u201cstaff_member_required\u201d, y redirige a un par\u00e1metro GET \u201cnext_url\u201d suministrado por el solicitante despu\u00e9s de solo verificar \u201csecure_url(next_url)\u201d, que simplemente verifica que el host de destino coincide con el dominio del sitio actual (bloqueando solo redirecciones entre dominios) mientras permite que cualquier ruta del mismo sitio sin requerir autenticaci\u00f3n acceda a la vista. Esto permite redirecciones de phishing no autenticadas y la fuga de tokens basada en el referente a trav\u00e9s de cadenas de redirecci\u00f3n."}], "id": "CVE-2026-71240", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71240", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T12:57:34.698525Z", "version": "2.0.3"}}]}, "published": "2026-08-05T11:16:26.873", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/DjangoCRM/django-crm"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "django-crm", "vendor": "djangocrm"}], "created": "2026-08-05T12:30:12.419057+00:00", "updated": "2026-08-10T22:00:05.260300+00:00", "vendors": ["djangocrm", "djangocrm$PRODUCT$django-crm"]}