Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

djust lets unauthorized users view restricted objects

CVE-2026-61596 · published 1 month ago
Summary

Versions of djust before 1.0.7 could show data to users who should not see it when they accessed pages directly, navigated within a single‑page app, or loaded embedded live views. This means an authenticated user might view or act on records they are not allowed to. Upgrade to djust 1.0.7 or later to stop the unauthorized access; there is no safe workaround other than updating.

What to do
  • Update djust contributors djust to version 1.0.7.
  • Update djust to version 1.0.7.
Affected software
Ecosystem VendorProductAffected versions
pip djust contributors djust < 1.0.7
Fix: upgrade to 1.0.7
pip – djust < 1.0.7
Fix: upgrade to 1.0.7
– djust-org djust < 1.0.7
Original advisory text
djust has broken object-level access control (IDOR)
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSocket mount and event paths but not on three other render entry points: (a) the initial HTTP GET render, (b) SPA `url_change` navigation, and (c) `{% live_render %}` embedded child views. An authenticated user could therefore view (and on some paths act on) an object they are not authorized for by loading the page directly, navigating to it via SPA url-change, or composing it as an embedded child — a classic IDOR / broken object-level access control on object-scoped views. This is fixed in djust 1.0.7. All render entry points now route through a shared `enforce_object_permission` chokepoint: HTTP GET returns 403, `url_change` emits a `permission_denied` frame and skips the render, and `{% live_render %}` (eager + lazy) refuses the embed. Views without a custom `get_object` are unaffected (no-op). No reliable workaround short of upgrading. Do not expose object-scoped views through the HTTP-GET / url_change / live_render paths until patched.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
CWE-862Missing Authorization
Timeline
Published16 Sep 2026
Updated4 Nov 2026
First seen16 Sep 2026
Sources
CVE-2026-61596 · OSV
GHSA-c7c5-5j6r-q957 · GHSA
CVE-2026-61596 · NVD
CVE-2026-61596 · MITRE
GHSA-c7c5-5j6r-q957 · OSV
PYSEC-2026-4041 · OSV
Track software like this
Free during beta