The vulnerability (CVE-2026-71240) exists in DjangoCRM's django-crm product where the toggle_default_sorting view is accessible without login or staff member restrictions. It redirects to a caller-supplied next_url GET parameter after verifying that the target host matches the current site's domain. However, this check only blocks cross-domain redirects and does not restrict same-site path redirects, allowing unauthenticated users to redirect to any path within the site. This constitutes a CWE-601 URL redirection to an untrusted site within the same domain context.

The impact is limited to potential URL redirection within the same site domain without authentication. There is no direct confidentiality or availability impact, but it may facilitate phishing or user confusion by redirecting users to unintended pages within the site. The CVSS score is 4.3 (medium severity) reflecting low impact on confidentiality and integrity and no impact on availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the toggle_default_sorting view by applying authentication decorators such as login_required or staff_member_required to prevent unauthenticated access. Additionally, improve validation of the next_url parameter to ensure it only redirects to safe and intended paths.