CVE-2026-61594

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name="dispatch")`, and custom `dispatch()` guards — and the djust admin extension's staff gate (applied only in the HTTP `as_view` wrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view — including admin list/create/change/delete — and dispatch its handlers. This is fixed in djust 1.0.7. `check_view_auth` now honors the Django `AccessMixin` family on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-`dispatch` forms); and the admin base mixin declares `login_required = True` + an active-staff `check_permissions` gate. As a workaround, gate views using djust's `login_required` / `permission_required` / `check_permissions` attributes (honored on all transports) rather than HTTP-only mixins/decorators.

• CWE-306
• CWE-862

• https://github.com/djust-org/djust/releases/tag/v1.0.7
• https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61589djust provides Phoenix LiveView-style reactive server-side r…6.3
• CVE-2026-6159A vulnerability has been found in code-projects Simple ChatB…4.3
• CVE-2026-61590djust provides Phoenix LiveView-style reactive server-side r…7.4
• CVE-2026-61591djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61592djust provides Phoenix LiveView-style reactive server-side r…7.4
• CVE-2026-61593djust provides Phoenix LiveView-style reactive server-side r…8.1
• CVE-2026-61595djust provides Phoenix LiveView-style reactive server-side r…7.7
• CVE-2026-61596djust provides Phoenix LiveView-style reactive server-side r…7.1
• CVE-2026-61597djust provides Phoenix LiveView-style reactive server-side r…5.1
• CVE-2026-61598djust provides Phoenix LiveView-style reactive server-side r…7.1
• CVE-2026-61599djust provides Phoenix LiveView-style reactive server-side r…8.8
• CVE-2026-6160A vulnerability was found in code-projects Simple ChatBox 1.…5.5