EUVD-2026-53313
GHSA-q389-cg45-h4hc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
PR:N confirmed by absent auth decorator; C:L added over NVD C:N to reflect referrer-based token leakage of sensitive URL-embedded credentials in redirect chains.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
1DescriptionCVE.org
DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view. This enables unauthenticated phishing redirects and referrer-based token leakage via redirect chains.
AnalysisAI
Unauthenticated open redirect in DjangoCRM's toggle_default_sorting view exposes users to same-site phishing and referrer-based token leakage. The endpoint is the sole route in common/urls.py lacking a login_required or staff_member_required decorator, and it redirects to a caller-supplied next_url GET parameter after only a domain-level check via secure_url() - permitting redirection to any arbitrary same-site path without authentication. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated attack surface combined with potential token harvest in redirect chains elevates practical risk beyond the 4.3 CVSS score alone.
Technical ContextAI
DjangoCRM is an open-source customer relationship management application built on the Django web framework, hosted at https://github.com/DjangoCRM/django-crm. The vulnerable endpoint, toggle_default_sorting in common/urls.py, is a utility view that adjusts column sort preferences and then redirects the browser back to the caller via a next_url GET parameter. The validation helper secure_url(next_url) restricts redirects only to the current site's domain by checking the host component, but it does not validate the path, query string, or fragment of the supplied URL. This constitutes CWE-601 (URL Redirection to Untrusted Site - Open Redirect), specifically a same-site open redirect variant. Because no Django authentication decorator is applied to this view - in contrast to every other URL in the same configuration file - any unauthenticated HTTP request can trigger the redirect logic. The referrer-based token leakage risk arises because browsers include the full Referer header when following redirect chains, which can expose sensitive URL-embedded tokens (password-reset links, session identifiers) to the intermediate redirect destination.
RemediationAI
The primary fix is to add a login_required or staff_member_required decorator to the toggle_default_sorting view in common/urls.py, consistent with all other routes in that URL configuration - this closes the authentication gap entirely. Alternatively, the next_url parameter validation should be extended beyond host-only checking to enforce an allowlist of permitted safe paths rather than accepting any same-site path. The upstream repository is at https://github.com/DjangoCRM/django-crm; no patched release version has been confirmed in the available intelligence, so defenders should monitor the repository for a tagged fix and apply it promptly when available. As a compensating control, a web application firewall or Django middleware can block unauthenticated external requests to the toggle_default_sorting endpoint, restricting access to authenticated sessions - this reduces exposure but does not fix the underlying missing decorator and should be treated as temporary. To address the referrer-based token leakage vector specifically, configure Referrer-Policy: no-referrer or same-origin on sensitive flows (password-reset, session-initialization pages) so tokens are not transmitted in Referer headers across redirect chains.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today