---
id: CVE-2026-61594
title: >-
  djust provides Phoenix LiveView-style reactive server-side rendering for
  Django with Rust-powered performance
summary: >-
  djust provides Phoenix LiveView-style reactive server-side rendering for
  Django with Rust-powered performance. Prior to version 1.0.7, the live
  (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's
  `View.dispatch()…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-306
  - CWE-862
vendor: djust-org
product: djust
affected:
  - djust < 1.0.7
patched:
  - djust 1.0.7
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T15:16:48.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61594'
references:
  - url: 'https://github.com/djust-org/djust/releases/tag/v1.0.7'
    label: security-advisories@github.com
  - url: 'https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-xhhm-f6hp-2qwj'
  - url: 'https://github.com/djust-org/djust'
tags:
  - nvd
  - cve.org
  - ghsa
  - pip
  - osv
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T14:38:54.966468Z'
aliases:
  - GHSA-xhhm-f6hp-2qwj
ecosystem: pip
ingestedAt: '2026-09-16T22:06:50.815Z'
epss: 0.00426
epssPercentile: 0.3651
---

## Overview

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name="dispatch")`, and custom `dispatch()` guards — and the djust admin extension's staff gate (applied only in the HTTP `as_view` wrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view — including admin list/create/change/delete — and dispatch its handlers. This is fixed in djust 1.0.7. `check_view_auth` now honors the Django `AccessMixin` family on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-`dispatch` forms); and the admin base mixin declares `login_required = True` + an active-staff `check_permissions` gate. As a workaround, gate views using djust's `login_required` / `permission_required` / `check_permissions` attributes (honored on all transports) rather than HTTP-only mixins/decorators.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61594)

Affected packages:

- `djust < 1.0.7`

Patched in:

- `djust 1.0.7`

Source: https://github.com/advisories/GHSA-xhhm-f6hp-2qwj