{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/djust--1.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:djust:djust:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-61595"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["djust (\u003c 1.0.7)","djust (\u003c= 1.1.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application","mass-assignment","cve-2026-61598","remote-code-execution","information-disclosure","cve-2026-61590","idor","broken-access-control","vulnerability","privilege-escalation","injection","xss","template-injection","djust"],"_cs_type":"advisory","_cs_vendors":["djust"],"content_html":"\u003cp\u003eThe djust package (versions prior to 1.0.7) suffers from a critical multi-tenant isolation failure affecting WebSocket and Server-Sent Events (SSE) connections. The vulnerability stems from the implementation of tenant identification, which relied on \u003ccode\u003ethreading.local()\u003c/code\u003e and an HTTP-only middleware. Because this middleware was not invoked on persistent connection paths (WebSocket/SSE), the \u003ccode\u003eget_current_tenant()\u003c/code\u003e function returned \u003ccode\u003eNone\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eConsequently, the tenant-aware \u003ccode\u003eQuerySet\u003c/code\u003e manager failed in an open state, returning unfiltered data instead of restricting access to the current tenant. This issue was compounded by the use of \u003ccode\u003esync_to_async\u003c/code\u003e executors, which shared thread-local storage across disparate connection contexts. This vulnerability allows an authenticated attacker to access data belonging to other tenants by initiating a WebSocket or SSE connection. The issue is addressed in version 1.0.7 by transitioning to \u003ccode\u003econtextvars.ContextVar\u003c/code\u003e and ensuring secure tenant binding during connection dispatch.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive data across all tenants within a djust-powered application. As the system defaults to returning unfiltered query sets when the tenant context is missing, any user with access to an active WebSocket or SSE endpoint can view records intended for other users or organizations. This vulnerability affects all applications using djust versions below 1.0.7 that utilize live connection features.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the djust package to version 1.0.7 or later immediately to resolve CVE-2026-61595.\u003c/li\u003e\n\u003cli\u003eAfter upgrading, verify that the application triggers system check S006 if \u003ccode\u003eSTRICT_MODE\u003c/code\u003e is disabled, as this check warns when tenant isolation protections are lowered.\u003c/li\u003e\n\u003cli\u003eAudit application logs for abnormal access patterns on WebSocket and SSE endpoints that may indicate unauthorized data harvesting from cross-tenant query results.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T01:12:08Z","date_published":"2026-09-16T19:07:43Z","id":"https://feed.craftedsignal.io/briefs/2026-09-djust-tenant-isolation/","summary":"A vulnerability in djust caused multi-tenant isolation to fail open on WebSocket and SSE paths, allowing unauthorized cross-tenant data disclosure due to improper tenant context propagation.","title":"Multi-tenant Isolation Bypass in djust via WebSocket/SSE","url":"https://feed.craftedsignal.io/briefs/2026-09-djust-tenant-isolation/"}],"language":"en","title":"CraftedSignal Threat Feed - Djust (\u003c= 1.1.0)","version":"https://jsonfeed.org/version/1.1"}