The vulnerability in DjangoCRM's django-crm product involves the toggle_default_sorting view, which is not protected by authentication decorators like login_required or staff_member_required. It redirects users based on a next_url GET parameter after checking only that the URL's host matches the current site domain, blocking cross-domain redirects but allowing any same-site path. Because no authentication is required to access this view, attackers can craft URLs that redirect users to malicious same-site paths, enabling phishing attacks and referrer-based token leakage through redirect chains. This is classified as CWE-601 (URL Redirection to Untrusted Site).

An attacker can exploit this vulnerability to perform phishing attacks by redirecting users to malicious pages within the same domain without authentication. Additionally, sensitive tokens or information could be leaked via referrer headers in redirect chains. There is no direct impact on confidentiality or availability beyond these redirect-based risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the toggle_default_sorting view by applying appropriate authentication controls such as login_required or staff_member_required decorators. Validate and sanitize the next_url parameter more strictly to ensure it does not allow unsafe redirects even within the same domain.