DjangoCRM vulnerabilities

Products

• django-crm 4

Latest DjangoCRM CVEs

Newest publication first

1. CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization

   Published 2026-09-14

   Medium·CVSS 5.3 EPSS 0.37%

   A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be c...

2. CVE-2026-71240 DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter

   Published 2026-08-05

   Medium·CVSS 4.3 EPSS 0.33%

   DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host...

3. CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering

   Published 2026-08-05

   High·CVSS 8.1 EPSS 0.39%

   DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Templ...

4. CVE-2026-71238 DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

   Published 2026-08-05

   Critical·CVSS 9.1 EPSS 0.44%

   DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository ca...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.