Djust (< 1.0.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/djust--1.0.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 19:07:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMulti-tenant Isolation Bypass in djust via WebSocket/SSEhttps://feed.craftedsignal.io/briefs/2026-09-djust-tenant-isolation/Wed, 16 Sep 2026 19:07:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-djust-tenant-isolation/A vulnerability in djust caused multi-tenant isolation to fail open on WebSocket and SSE paths, allowing unauthorized cross-tenant data disclosure due to improper tenant context propagation.The djust package (versions prior to 1.0.7) suffers from a critical multi-tenant isolation failure affecting WebSocket and Server-Sent Events (SSE) connections. The vulnerability stems from the implementation of tenant identification, which relied on threading.local() and an HTTP-only middleware. Because this middleware was not invoked on persistent connection paths (WebSocket/SSE), the get_current_tenant() function returned None.

Consequently, the tenant-aware QuerySet manager failed in an open state, returning unfiltered data instead of restricting access to the current tenant. This issue was compounded by the use of sync_to_async executors, which shared thread-local storage across disparate connection contexts. This vulnerability allows an authenticated attacker to access data belonging to other tenants by initiating a WebSocket or SSE connection. The issue is addressed in version 1.0.7 by transitioning to contextvars.ContextVar and ensuring secure tenant binding during connection dispatch.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive data across all tenants within a djust-powered application. As the system defaults to returning unfiltered query sets when the tenant context is missing, any user with access to an active WebSocket or SSE endpoint can view records intended for other users or organizations. This vulnerability affects all applications using djust versions below 1.0.7 that utilize live connection features.

Recommendation

  • Upgrade the djust package to version 1.0.7 or later immediately to resolve CVE-2026-61595.
  • After upgrading, verify that the application triggers system check S006 if STRICT_MODE is disabled, as this check warns when tenant isolation protections are lowered.
  • Audit application logs for abnormal access patterns on WebSocket and SSE endpoints that may indicate unauthorized data harvesting from cross-tenant query results.
]]>criticaladvisoryweb-applicationmass-assignmentcve-2026-61598remote-code-executioninformation-disclosurecve-2026-61590idorbroken-access-controlvulnerabilityprivilege-escalationinjectionxsstemplate-injectiondjustCross-Site Request Forgery Vulnerability in djust SSE Transporthttps://feed.craftedsignal.io/briefs/2026-09-djust-csrf/Wed, 16 Sep 2026 19:07:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-djust-csrf/The djust library before version 1.0.7 is vulnerable to CSRF via its SSE transport, allowing cross-origin requests to execute state-changing event handlers as an authenticated victim.The djust library, prior to version 1.0.7, contains a high-severity Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-61593) affecting its Server-Sent-Events (SSE) transport implementation. The vulnerability stems from a lack of Origin header validation on SSE endpoints and the use of CSRF-exempted POST endpoints. Because the library allows client-chosen session identifiers and accepts requests with a 'text/plain' content type, an attacker can bypass CORS preflight checks to perform 'simple requests' from a malicious cross-origin page. This enables an attacker to force an authenticated victim's browser to establish an SSE session, mount a LiveView, and execute state-changing event handlers on behalf of the victim. Defenders should prioritize patching to version 1.0.7, which introduces strict Origin validation against 'ALLOWED_HOSTS' and mandates 'application/json' content-type checks.

Impact

Successful exploitation allows an unauthorized remote attacker to perform state-changing actions within the application context of an authenticated victim. This can lead to unauthorized data modification, account takeover, or the execution of privileged administrative actions. The vulnerability affects all applications using djust prior to version 1.0.7.

Recommendation

  • Upgrade the djust package to version 1.0.7 or later to implement required Origin validation and content-type enforcement.
  • If immediate patching is not possible, disable the SSE transport entirely or implement a reverse proxy layer capable of enforcing strict Origin header allowlisting for all traffic directed to the SSE endpoints.
  • Monitor web server access logs for anomalous cross-origin POST requests or SSE stream requests originating from unexpected domains.
]]>mediumadvisoryweb-application-securitycsrfssevulnerability