CVE-2026-61595

7.7 HIGHpublic exploit available

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: The flaw in djust prior to version 1.0.7 allows unauthorized access to tenant-specific data over WebSocket/SSE connections, due to improper tenant isolation.
Exploitability: Exploitation is moderately hard as it requires the attacker to establish a WebSocket/SSE connection, and the current tenant is not properly isolated.
Blast radius: If exploited, this could lead to data leakage across tenants, compromising sensitive information for all users.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to djust 1.0.7 or later.

webwebsocketssetenant-isolation

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket/SSE) path `get_current_tenant()` was always `None` during mount and every event handler — and the tenant-aware `QuerySet` manager failed OPEN (returned the unfiltered queryset, ignoring `STRICT_MODE`), disclosing every tenant's rows to whoever held the socket. `threading.local` was additionally shared across connections on the `sync_to_async` executor thread. This issue is fixed in djust 1.0.7. Tenant storage moved to a `contextvars.ContextVar` (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (`.none()` under the default `STRICT_MODE`); and system check S006 warns when `STRICT_MODE=False`. No known workarounds are available on the live path.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CWE-636, CWE-862

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.