CVE-2026-61595
- Source
- https://cve.org/CVERecord?id=CVE-2026-61595
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61595.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-61595
- Aliases
- Published
- 2026-09-16T15:33:40Z
- Modified
- 2026-09-18T03:48:29Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
- Details
-
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7,
djust.tenantsisolation was enforced only on the HTTP path. The current tenant was stored inthreading.local()and set exclusively by the HTTP-onlyTenantMiddleware, so on the live (WebSocket/SSE) pathget_current_tenant()was alwaysNoneduring mount and every event handler — and the tenant-awareQuerySetmanager failed OPEN (returned the unfiltered queryset, ignoringSTRICT_MODE), disclosing every tenant's rows to whoever held the socket.threading.localwas additionally shared across connections on thesync_to_asyncexecutor thread. This issue is fixed in djust 1.0.7. Tenant storage moved to acontextvars.ContextVar(per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (.none()under the defaultSTRICT_MODE); and system check S006 warns whenSTRICT_MODE=False. No known workarounds are available on the live path. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-636", "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61595.json" }- References