TI-2026-61709 CVE-2026-90806 · GHSA-3pwq-wqwf-8857
DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
Priority LOW 24
A vulnerability has been found in DjangoCRM django-crm up to 1.2.
Vulnerabilities
4 records
TI-2026-49911 CVE-2026-71240 · GHSA-q389-cg45-h4hc
DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter
Priority LOW 20
DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking…
TI-2026-49910 CVE-2026-71239 · GHSA-qwf5-72hq-pg7x
DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
Priority LOW 37
DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string emb…
TI-2026-49909 CVE-2026-71238 · GHSA-qc6p-hvpv-4f8h
DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
Priority MEDIUM 48
DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable.