CVE-2026-61596

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7

Description An issue exists in the per-object authorization mechanism involving the get object() and has object permission() functions. While authorization was enforced on WebSocket mount and event paths, it was missing from the initial HTTP GET render, SPA url change navigation, and {% live render %} embedded child views. This results in an Insecure Direct Object Reference (IDOR), where an authenticated user can view or interact with objects they are not authorized to access by loading the page directly, using SPA navigation, or composing it as an embedded child. This specifically affects object-scoped views; views without a custom get object() function are not impacted.

Recommendations Update djust to version 1.0.7. Do not expose object-scoped views through HTTP GET, url change, or live render paths until the update is applied.