GHSA-3492-cvg7-9mr2

Suggest an improvement
Source
https://github.com/advisories/GHSA-3492-cvg7-9mr2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3492-cvg7-9mr2/GHSA-3492-cvg7-9mr2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3492-cvg7-9mr2
Aliases
Published
2026-09-16T15:32:10Z
Modified
2026-09-16T15:45:10Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
Details

Impact

djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware, so on the live (WebSocket/SSE) path get_current_tenant() was always None during mount and every event handler — and the tenant-aware QuerySet manager failed OPEN (returned the unfiltered queryset, ignoring STRICT_MODE), disclosing every tenant's rows to whoever held the socket. threading.local was additionally shared across connections on the sync_to_async executor thread.

Patches

Fixed in djust 1.0.7. Tenant storage moved to a contextvars.ContextVar (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (.none() under the default STRICT_MODE); and system check S006 warns when STRICT_MODE=False.

Workarounds

No workaround on the live path short of upgrading.

Database specific 
{
    "cwe_ids": [
        "CWE-636",
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-16T15:32:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

PyPI / djust

Package

Name
djust
View open source insights on deps.dev
Purl
pkg:pypi/djust

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.7

Affected versions

0.*
0.1.0
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.9.0
0.9.1
0.9.2
0.9.4
0.9.5
0.9.6
0.9.7
1.*
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.0.0rc4
1.0.0rc6
1.0.0rc7
1.0.0rc8
1.0.0rc9
1.0.0rc10
1.0.0rc11
1.0.0rc12
1.0.0rc13
1.0.0rc14
1.0.0rc15
1.0.0rc16
1.0.0rc17
1.0.0rc18
1.0.0
1.0.1rc1
1.0.1
1.0.2rc1
1.0.2rc2
1.0.2rc3
1.0.2
1.0.3rc1
1.0.3rc2
1.0.3
1.0.4rc1
1.0.4
1.0.5rc1
1.0.5rc2
1.0.5rc3
1.0.5rc4
1.0.5rc5
1.0.5
1.0.6rc1
1.0.6rc2
1.0.6rc3
1.0.6
1.0.7rc1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3492-cvg7-9mr2/GHSA-3492-cvg7-9mr2.json"