CVE-2026-61594
- Source
- https://cve.org/CVERecord?id=CVE-2026-61594
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61594.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-61594
- Aliases
- Published
- 2026-09-16T21:59:01Z
- Modified
- 2026-09-19T03:30:46Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- djust has an authorization bypass on the WebSocket/SSE mount path
- Details
-
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via
check_view_auth, not Django'sView.dispatch()chain. As a result, standard Django authorization —LoginRequiredMixin,PermissionRequiredMixin,UserPassesTestMixin,@method_decorator(login_required, name="dispatch"), and customdispatch()guards — and the djust admin extension's staff gate (applied only in the HTTPas_viewwrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view — including admin list/create/change/delete — and dispatch its handlers. This is fixed in djust 1.0.7.check_view_authnow honors the DjangoAccessMixinfamily on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-dispatchforms); and the admin base mixin declareslogin_required = True+ an active-staffcheck_permissionsgate. As a workaround, gate views using djust'slogin_required/permission_required/check_permissionsattributes (honored on all transports) rather than HTTP-only mixins/decorators. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-306", "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61594.json" }- References