The vulnerability arises from the massmail module rendering user‑controlled message subject and content fields through Django's Template() constructor without any sanitization. In message_previews.py, email_creators.py, and helpers.py, f‑strings embed the raw subject or content directly into a Template() call. An authenticated user who has rights to edit mass‑mail messages can inject Django template syntax ({{ }}, {% %}) which is evaluated when the message is rendered. This enables the attacker to read other users’ data, exfiltrate password hashes via the request context, forge CSRF tokens, or include arbitrary templates.

The affected product is DjangoCRM’s django‑crm, specifically the massmail module. The CVE data does not list specific version ranges, indicating that all releases that include the vulnerable code paths are impacted. No version information is available, so administrators should consider all installations of django‑crm that contain the massmail component as potentially affected.

With a CVSS score of 8.8 the vulnerability is considered High severity. The EPSS score is not available, and it is not listed in CISA’s KEV. Exploitation requires an authenticated user with mass‑mail edit permissions; hence the attack vector is internal or privileged rather than remote. Despite the limited scope of the attacker’s privileges, the impact on data confidentiality and integrity is significant, making prompt remediation essential.