CVE-2026-61595

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7

Description Isolation in djust.tenants was only enforced on the HTTP path. The current tenant was stored in threading.local() and set exclusively by the TenantMiddleware, which is HTTP-only. Consequently, on the live path (WebSocket/SSE), the get current tenant() function always returned None during mount and every event handler. This caused the tenant-aware QuerySet manager to fail OPEN, returning unfiltered querysets and ignoring STRICT MODE, which disclosed data from all tenants to any user holding a socket. Additionally, threading.local was shared across connections on the sync to async executor thread.

Recommendations Update to version 1.0.7.