DjangoCRM’s toggle_default_sorting view is exposed without authentication and redirects to a caller‑supplied next_url after only verifying that the host matches the current site. This open redirect, recognized as CWE‑601, permits an attacker to manipulate the redirect destination, enabling phishing attacks and the possibility of leaking sensitive tokens through referrer chains. The impact is limited to confidentiality and integrity of users’ session data rather than direct code execution or denial of service.

Any deployment of the DjangoCRM django‑crm app that includes the unprotected toggle_default_sorting route, irrespective of version, is vulnerable. No specific version information is supplied, so the risk applies broadly to installed instances.

The CVSS score of 5.4 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the redirect by simply visiting the route with a crafted next_url parameter, making exploitation trivial without authentication or elevated privileges. The primary attack vector is a network request to the vulnerable endpoint, which may happen through link clicking or malicious code in web pages. Given the lack of mitigation on the server side, the risk of successful phishing or token leakage is significant in environments where the site is publicly reachable.