CVE-2026-61594

The Python/Django live-view library djust (CVE-2026-61594) fails to enforce standard Django authorization on its WebSocket (live) transport: views are mounted via check_view_auth instead of Django's View.dispatch() chain, so protections such as LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, login_required decorators, custom dispatch() guards, and the djust admin staff gate apply only to the initial HTTP GET and are silently bypassed over WebSocket. Any anonymous or under-privileged client can open a WebSocket connection and mount such a view, causing its handlers to run. Because all events and state flow over WebSocket, an attacker can reach full read and write handlers — including the djust admin extension's list/create/change/delete operations — yielding high confidentiality and integrity impact (CVSS 3.1: 9.1 critical). All djust deployments that protect WebSocket-mounted views or admin routes with Django mixins, decorators, or overridden dispatch() are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and there are no reports of exploitation in the wild.

What to do: Upgrade to djust 1.0.7 or later, where check_view_auth honors the Django AccessMixin family on every transport, system check S004 flags unsafe auth patterns at startup, and the admin mixin enforces login plus active-staff permissions. As an interim workaround, gate WebSocket-mounted views using djust's own login_required, permission_required, or check_permissions attributes instead of HTTP-only Django mixins or decorators. Audit all WebSocket-mounted views (especially admin routes) and review access logs for anonymous WebSocket connections that mounted privileged views.