What is CVE-2026-71238?

CVE-2026-71238 is a critical-severity vulnerability in Djangocrm Django-Crm, classified under Use of Hard-coded Credentials. CVSS score: 9.1/10. Published 2026-08-05.

How severe is CVE-2026-71238?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Djangocrm Django-Crm

CVE-2026-71238

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.

EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Djangocrm Django-crm — versions 0

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (third-party-advisory)

Frequently asked questions

What is CVE-2026-71238?: CVE-2026-71238 is a critical-severity vulnerability in Djangocrm Django-Crm, classified under Use of Hard-coded Credentials. CVSS score: 9.1/10. Published 2026-08-05.
How severe is CVE-2026-71238?: Critical severity. CVSS v3 base score is 9.1 out of 10.