DjangoCRM CVE-2026-71239

Exploitation requires an account authenticated to DjangoCRM that holds the specific 'mass-mail message edit rights' permission within the massmail module - this is not a default permission for all authenticated users and must be explicitly assigned. The attacker must be able to create or modify EmlMessage objects (subject or content fields) and trigger rendering through a preview operation or email send action in one of the three affected code paths. The massmail module must be active in the DjangoCRM installation. Exploitation is strictly limited to users holding the mass-mail edit permission; unauthenticated users and authenticated users without this specific permission cannot reach the vulnerable code. The attack is platform-agnostic but requires a live DjangoCRM web instance. The CVSS vector PR:L confirms low-privilege authenticated access is the minimum bar - not PR:N - which is the primary limiting factor for attack surface exposure.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N scores 8.1, which accurately reflects the network-accessible attack surface, low complexity, and dual high-impact outcomes. PR:L correctly captures the gating condition: exploitation requires an authenticated account with mass-mail edit rights, which is not the default for all users, partially mitigating real-world risk in well-administered deployments. The S:U (unchanged scope) rating is consistent with Django's DTL model, which does not grant arbitrary OS-level code execution by default, bounding the blast radius to the application tier. EPSS data is absent from the available intelligence, making exploitation probability quantification impossible. No CISA KEV listing is present and no POC exploit code has been identified, distinguishing this from actively exploited SSTI variants. The most operationally severe impacts are the password hash disclosure (enabling offline cracking) and CSRF token exfiltration (enabling authenticated action forgery against other users). Real-world priority is high for organizations where DjangoCRM mass-mail edit rights are delegated to non-administrative or semi-trusted users; lower in tightly controlled deployments where only system administrators hold that permission.

An attacker authenticated to DjangoCRM with mass-mail edit rights creates an EmlMessage with a subject field containing a payload such as {% for u in request.user.__class__.objects.all %}{{ u.username }}:{{ u.password }},{% endfor %}. When the application renders a message preview via message_previews.py or processes the message through email_creators.py, Django's Template() instantiates the attacker's string as a live template and resolves all User ORM objects in context, returning a comma-separated list of usernames and password hashes in the rendered output. No public POC has been identified, but the SSTI technique against Django's Template() class is well-documented in open security research.