CVE-2026-61596 Overview
CVE-2026-61596 is a broken object-level access control vulnerability in djust, a library that provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Versions prior to 1.0.7 enforce per-object authorization only on the WebSocket mount and event paths. Three additional render entry points bypass the get_object and has_object_permission checks defined under ADR-017. An authenticated user can view unauthorized objects through the initial HTTP GET render, SPA url_change navigation, or {% live_render %} embedded child views. The flaw is classified as an Insecure Direct Object Reference [CWE-639].
Critical Impact
Authenticated users can access and, on some paths, act on object-scoped views they are not authorized for by loading pages directly, navigating via SPA URL changes, or composing embedded child views.
Affected Products
- djust versions prior to 1.0.7
- Django applications using djust with custom get_object implementations
- Views relying on has_object_permission under ADR-017
Discovery Timeline
- 2026-09-16 - CVE-2026-61596 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-61596
Vulnerability Analysis
djust enforces per-object authorization through the get_object and has_object_permission hooks defined in architectural decision record ADR-017. The framework applied these checks correctly on the WebSocket mount path and event handlers. However, three parallel render entry points bypassed enforcement entirely.
The initial HTTP GET render served the view without invoking the authorization chokepoint. SPA navigation via url_change frames rendered target views without verifying object permissions. Embedded child views composed through the {% live_render %} template tag inherited no authorization from their parent context.
An authenticated attacker can enumerate object identifiers and load restricted resources through any of these three paths. On paths that also accept subsequent events, the attacker may perform actions on objects outside their authorization scope.
Root Cause
The root cause is inconsistent enforcement of object-level authorization across render entry points. Authorization logic was implemented as path-specific middleware rather than a shared chokepoint. This design gap allowed HTTP GET, url_change, and {% live_render %} code paths to render object-scoped views without invoking has_object_permission.
Attack Vector
An authenticated user issues a direct HTTP GET request to an object-scoped view URL substituting an object identifier they do not own. Alternatively, the attacker triggers an SPA url_change event pointing to an unauthorized object URL. A third path involves crafting a template context that embeds the target view through {% live_render %} as an eager or lazy child. See the GitHub Security Advisory GHSA-c7c5-5j6r-q957 for full technical detail.
Detection Methods for CVE-2026-61596
Indicators of Compromise
- HTTP GET requests to object-scoped view URLs where the requesting user ID does not match the object owner in application logs.
- SPA url_change WebSocket frames referencing object identifiers outside the authenticated user's authorization scope.
- Rendered responses containing object data for users whose session context should not authorize access.
Detection Strategies
- Audit djust view definitions for custom get_object implementations and correlate access logs against object ownership records.
- Compare pre-upgrade and post-upgrade response codes for object-scoped URLs; expect 403 responses after patching where prior access succeeded.
- Instrument the shared enforce_object_permission chokepoint in version 1.0.7 to log every denial for historical review.
Monitoring Recommendations
- Enable request-level logging that captures authenticated user identity, requested object ID, and response status for all djust views.
- Monitor WebSocket telemetry for permission_denied frames introduced in version 1.0.7 as indicators of prior probing attempts.
- Alert on unusual enumeration patterns against object-scoped endpoints, particularly sequential integer object identifiers.
How to Mitigate CVE-2026-61596
Immediate Actions Required
- Upgrade djust to version 1.0.7 or later, which routes all render entry points through the shared enforce_object_permission chokepoint.
- Inventory all views that implement custom get_object methods and treat them as high-priority exposure until upgraded.
- Review application access logs for prior unauthorized access to object-scoped views and notify affected data subjects if required.
Patch Information
djust 1.0.7 introduces a shared enforce_object_permission chokepoint invoked by every render entry point. HTTP GET returns 403, url_change emits a permission_denied frame and skips rendering, and {% live_render %} refuses to embed unauthorized views in both eager and lazy modes. Views without a custom get_object are unaffected. Full release notes are available in the GitHub Release v1.0.7.
Workarounds
- No reliable workaround exists short of upgrading to djust 1.0.7.
- Do not expose object-scoped views through the HTTP GET, url_change, or {% live_render %} paths until the upgrade is complete.
- Restrict object-scoped views to the WebSocket mount and event paths where authorization is enforced in vulnerable versions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
