CVE-2026-61596: Broken Object-Level Access Control (IDOR) in djust Framework
Vulnerability ID: CVE-2026-61596
CVSS Score: 7.1
Published: 2026-09-16
A broken object-level access control (IDOR) vulnerability exists in the djust Django framework prior to version 1.0.7. The framework's per-object authorization hooks were enforced correctly over WebSockets but entirely bypassed on synchronous HTTP GET rendering, SPA client-side navigation, and embedded sub-views, allowing authenticated attackers to view arbitrary unauthorized database records.
TL;DR
The djust framework omitted authorization checks on non-WebSocket rendering paths, allowing authenticated users to bypass object-level permissions and access sensitive records.
Technical Details
- CWE ID: CWE-639, CWE-862
- Attack Vector: Network
- CVSS v3.1 Score: 7.1
- EPSS Score: N/A
- Impact: High (Confidentiality)
- Exploit Status: None
- CISA KEV Status: Not Listed
Affected Systems
- djust framework
Mitigation Strategies
- Upgrade djust to version 1.0.7 or later.
- Manually wrap vulnerable HTTP and template dispatch flows with authorization checks if immediate patching is unfeasible.
Remediation Steps:
- Verify current djust installation version using pip.
- Execute update command to obtain version 1.0.7 or higher.
- Run the framework regression test suite to confirm the fix is correctly applied.
References
Read the full report for CVE-2026-61596 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)