CVE-2026-61598: djust Privilege Escalation Vulnerability

CVE-2026-61598 Overview

CVE-2026-61598 is a mass assignment vulnerability in djust, a library that provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Versions prior to 1.0.7 expose a default update_model event handler through djust.mixins.model_binding.ModelBindingMixin, which is included in the LiveView base MRO. Any authenticated client connected to the WebSocket can set arbitrary public view attributes by sending an update_model event with a chosen field and value. The vulnerability maps to [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes].

Critical Impact
Clients can modify sensitive view attributes such as account_id, is_admin, or total_price over the WebSocket, breaking application authorization and data integrity assumptions.

Affected Products

djust versions prior to 1.0.7
Django applications using djust.mixins.model_binding.ModelBindingMixin
Any LiveView subclass inheriting the default update_model handler

Discovery Timeline

2026-09-16 - CVE-2026-61598 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-61598

Vulnerability Analysis

The ModelBindingMixin class ships a default update_model event handler that calls setattr on the view using a client-supplied field name. Because the mixin is part of the LiveView base MRO, every LiveView subclass exposes this handler without opt-in. The handler gates writes with four checks: names prefixed with _ are rejected, a 14-entry FORBIDDEN_MODEL_FIELDS denylist blocks framework internals, an optional allowed_model_fields allowlist defaults to None (allow all), and the target attribute must already exist via hasattr.

The checks do not cover developer business or authorization state. A view that binds a single dj-model="search" input but also carries self.account_id, self.is_admin, or self.total_price as view attributes exposes all of them to the client. Type coercion aligns the incoming value with the target attribute's Python type, so a string "true" becomes boolean True, easing exploitation.

Root Cause

The root cause is an opt-out security model combined with dynamic attribute assignment. The allowlist is disabled by default, and the denylist enumerates framework plumbing rather than application-sensitive fields. Developers implicitly trust that only fields bound with dj-model= in templates are writable, but the runtime accepts any public existing attribute.

Attack Vector

An attacker with an active WebSocket session to a vulnerable LiveView sends a JSON message of the form {type: "event", event: "update_model", params: {field: "is_admin", value: true}}. The server invokes setattr(view, "is_admin", True) after coercing the value. Subsequent view logic, authorization checks, or template rendering then operate on the attacker-controlled state. Exploitation requires low privileges (an authenticated session) and no user interaction.

See the GitHub Security Advisory GHSA-cc7c-9jff-58wj for the maintainer's technical write-up.

Detection Methods for CVE-2026-61598

Indicators of Compromise

WebSocket frames carrying event: "update_model" with field values that do not correspond to any dj-model= binding in the rendered template.
Unexpected mutations of sensitive server-side attributes such as is_admin, account_id, total_price, or user_id mid-session.
Application logs showing privilege changes or ownership transitions without a corresponding authenticated administrative action.

Detection Strategies

Instrument the ModelBindingMixin.update_model handler to log every field it accepts along with the view class name and session identity.
Compare accepted field names against the static list of dj-model= bindings declared in each template and alert on drift.
Deploy runtime rules that flag WebSocket events attempting to set attributes matching authorization-related name patterns.

Monitoring Recommendations

Aggregate LiveView WebSocket telemetry in a centralized data lake and pivot on update_model events per session.
Track anomalous rates of update_model events per user or IP address that exceed baseline UI interaction volumes.
Correlate update_model mutations with downstream authorization decisions to identify successful privilege escalations.

How to Mitigate CVE-2026-61598

Immediate Actions Required

Upgrade djust to version 1.0.7 or later, which contains the maintainer's fix for the mass assignment issue.
Audit every LiveView subclass to identify view attributes that hold authorization, ownership, or pricing state.
Set allowed_model_fields explicitly on every view that uses dj-model or subclasses LiveView, restricted to the minimal set of bindable fields.
Rotate credentials and revalidate authorization state for sessions that may have interacted with vulnerable views.

Patch Information

The issue is fixed in djust 1.0.7. Release notes are available at GitHub Release v1.0.7. Upgrade using standard Python package management and redeploy affected Django applications.

Workarounds

Set allowed_model_fields on every LiveView to an explicit allowlist matching only the fields bound with dj-model= in templates.
Move authorization and ownership state (account_id, is_admin, user_id, total_price) out of public view attributes and into private (_-prefixed) attributes or session-scoped storage.
Override or remove the inherited update_model handler on views that do not require client-driven attribute binding.

bash

# Configuration example
pip install --upgrade 'djust>=1.0.7'