Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61596— djust has broken object-level access control (IDOR)

Quick assessment

Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

djust 漏洞描述翻译： djust 为 Django 提供类似 Phoenix LiveView 的响应式服务端渲染，并结合 Rust 实现高性能表现。在 1.0.7 版本之前，djust 的对象级权限控制（ + ，对应 ADR-017）仅在 WebSocket 挂载（mount）和事件（event）路径上强制执行，却未在另外三个渲染入口点生效： (a) 初始 HTTP GET 请求的渲染， (b) SPA（单页应用）的 导航， (c) 嵌入的子视图。 因此，一个已认证的用户可能通过以下方式查看（在某些路径下甚

CVSS 7.1 · High

Possible ATT&CK Techniques 2 AI

T1124 · System Time Discovery T1579
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61596

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
djust has broken object-level access control (IDOR)
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSocket mount and event paths but not on three other render entry points: (a) the initial HTTP GET render, (b) SPA `url_change` navigation, and (c) `{% live_render %}` embedded child views. An authenticated user could therefore view (and on some paths act on) an object they are not authorized for by loading the page directly, navigating to it via SPA url-change, or composing it as an embedded child — a classic IDOR / broken object-level access control on object-scoped views. This is fixed in djust 1.0.7. All render entry points now route through a shared `enforce_object_permission` chokepoint: HTTP GET returns 403, `url_change` emits a `permission_denied` frame and skips the render, and `{% live_render %}` (eager + lazy) refuses the embed. Views without a custom `get_object` are unaffected (no-op). No reliable workaround short of upgrading. Do not expose object-scoped views through the HTTP-GET / url_change / live_render paths until patched.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
djust-org djust < 1.0.7 -

II. Public POCs for CVE-2026-61596

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61596

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-61596 (1)

Vendor Pages for CVE-2026-61596 (1)

Same Patch Batch · djust-org · 2026-09-16 · 12 CVEs total

CVE-2026-61594 9.1 CRITICAL djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61599 8.8 HIGH djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
CVE-2026-61593 8.1 HIGH djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p
CVE-2026-61591 8.1 HIGH djust: Unsigned client state snapshot is restored as trusted view state (privilege escalat
CVE-2026-61595 7.7 HIGH djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenan
CVE-2026-61590 7.4 HIGH djust's observability endpoints are network-exposed: the localhost gate is an opt-in middl
CVE-2026-61592 7.4 HIGH djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id
CVE-2026-61598 7.1 HIGH Client mass-assignment of arbitrary view attributes via the default dj-model update_model
CVE-2026-61588 6.5 MEDIUM djust's Django model serialization has no sensitive-field denylist: password hashes, privi
CVE-2026-61589 6.3 MEDIUM djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdoma
CVE-2026-61597 5.1 MEDIUM djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component tem

IV. Related Vulnerabilities

Same product: djust
Same vendor: djust-org
Same weakness: CWE-639

V. Comments for CVE-2026-61596

No comments yet

Leave a comment