Vulnerability in djust (CVE-2026-61596)
Summary
Vulnerability in djust (CVE-2026-61596). Confidential information can be exposed externally. Exploitable via get_object. Mitigation: upgrade to 1.0.7 or later.
Original description
The description as published by the source.
Impact
djust's per-object authorization (get_object + has_object_permission, ADR-017) was enforced on the WebSocket mount and event paths but not on three other render entry points: (a) the initial HTTP GET render, (b) SPA url_change navigation, and (c) {% live_render %} embedded child views. An authenticated user could therefore view (and on some paths act on) an object they are not authorized for by loading the page directly, navigating to it via SPA url-change, or composing it as an embedded child — a classic IDOR / broken object-level access control on object-scoped views.
Patches
Fixed in djust 1.0.7. All render entry points now route through a shared enforce_object_permission chokepoint: HTTP GET returns 403, url_change emits a permission_denied frame and skips the render, and {% live_render %} (eager + lazy) refuses the embed. Views without a custom get_object are unaffected (no-op).
Workarounds
No reliable workaround short of upgrading. Do not expose object-scoped views through the HTTP-GET / url_change / live_render paths until patched.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-61596 has been found in djust.
Attackers can target a specific entry point like get_object over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 7.1/10.
What to do: upgrade djust to 1.0.7 or later.
If unsure, ask your IT team or search "djust CVE-2026-61596" on the vendor's site.
CVE-2026-61596 (djust) — CWE-639 / CVSS v3 7.1
Attack vector: remote (network-reachable) / no user interaction
Attack surface: get_object / has_object_permission / url_change / enforce_object_permission
Patched: 1.0.7 — apply immediately
Workaround: No reliable workaround short of upgrading.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-639) exists in djust. Attackers reach the vulnerable code path via get_object.
Check the vendor advisory for the affected versions of djust. Attack surface: get_object / has_object_permission / url_change / enforce_object_permission.
Severity: High (CVSS 7.1/10). Confidential information can be exposed externally.
Update to 1.0.7.
Workaround: No reliable workaround short of upgrading.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'djust' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'djust' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
djustを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
No reliable workaround short of upgrading.パッチが適用されるまでの応急処置として、No reliable workaround short of upgrading. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade djust to 1.0.7ステージング環境で 1.0.7 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web github.com
- web github.com