Unauthenticated phishing redirects and referrer-based token leakage are possible due to insecure redirect handling in DjangoCRM's toggle_default_sorting view. This view does not require authentication or staff member privileges, allowing unauthenticated users to perform phishing redirects and potentially leak tokens via redirect chains. The insecure redirect handling is caused by the view's use of secure_ [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T11:16:26.750Z and has not been modified since then. The vulnerability, CVE-2026-71239, exists within DjangoCRM's massmail module, where user-controlled EmlMessage fields are rendered through Django's Template() constructor without sanitization. This oversight allows authenticated users with mass- [truncated]
CVE-2026-71238 is a critical vulnerability in DjangoCRM where the Django SECRET_KEY is hardcoded in the webcrm/settings.py file. This key is crucial for session signing, CSRF token generation, and password reset tokens, allowing attackers to forge valid session cookies, CSRF tokens, and password reset tokens, leading to full account takeover. The repository also has DEBUG=True by default, causing error pa [truncated]
