CVE-2026-61596

djust, a Python (pip) live-view framework for Django, failed to enforce its per-object authorization checks (get_object plus has_object_permission, per ADR-017) on three render entry points: the initial HTTP GET render, SPA url_change navigation, and {% live_render %} embedded child views, even though those checks were correctly applied on the WebSocket mount and event paths. An authenticated user could trigger the flaw simply by loading an object-scoped page directly, navigating to it via SPA url-change, or composing it as an embedded live_render child, without ever passing through the authorized WebSocket paths. This yields a classic IDOR (CWE-639/CWE-862): the attacker gains read access to objects they are not authorized to see, and on some paths can also act on them. Only applications using djust versions before 1.0.7 with object-scoped views that define a custom get_object are affected; views without a custom get_object are unaffected. No public proof-of-concept is known, the flaw is not in CISA KEV, and no exploitation has been reported.

What to do: Upgrade to djust 1.0.7, which routes all render entry points through a shared enforce_object_permission chokepoint (HTTP GET returns 403, url_change emits a permission_denied frame, and live_render refuses the embed). Until patched, do not expose views that define a custom get_object through HTTP GET, SPA url_change, or {% live_render %} paths, and audit such views for object-level authorization bypass. There is no reliable workaround short of upgrading.