CVE-2026-71238

Summary

The flaw lies in DjangoCRM hardcoding the Django SECRET_KEY in the settings.py file, allowing anyone to read the public repository to forge session cookies, CSRF tokens, and password reset tokens, leading to full account takeover.

Exploitability

Exploitation is relatively straightforward as anyone with access to the public repository can read the hardcoded key, making it easy to forge valid session cookies and other tokens.

Blast radius

If exploited, the impact is severe as it allows full account takeover, potentially compromising all user accounts, including the superadmin account.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of DjangoCRM that addresses this issue, ensuring the SECRET_KEY is read from an environment variable.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.