djust CVE-2026-61591

Exploitation requires all of the following: (1) the target djust view must opt into state snapshots (a non-default feature the vendor's workaround says to disable), (2) the application must hold authorization or ownership state such as is_admin, account_id, or balance in public view attributes, and (3) the attacker must have a low-privileged authenticated session able to trigger a back-navigation reconnect mount frame (PR:L). The limiting factors are the opt-in snapshot feature and the developer anti-pattern of trusting public view attributes for authorization; applications that avoid either - or that upgrade to djust 1.0.7 where snapshots are signed and unsigned/forged ones are rejected - are not exploitable. No user interaction by a victim is required (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) is internally consistent with the described flaw: a network-reachable, low-complexity attack requiring only a low-privileged authenticated session (any client that can hold a view), yielding high confidentiality and integrity impact via privilege escalation, with no availability impact. There is a real gating condition that raises AC in practice but not in the vector: the affected view must opt into state snapshots AND the application must store authorization/ownership state (is_admin, account_id, balance) in public view attributes - the vendor's own workaround confirms both are avoidable. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so this is not confirmed as actively exploited; it is a credible authenticated privilege-escalation issue rather than a mass-exploited internet-wide threat. The main risk driver is the low deployment footprint of djust, which caps real-world exposure despite the high base score. No signal conflicts are present in the data, though the absence of EPSS/KEV/POC leaves exploitation likelihood inferred rather than measured.

An authenticated user of a djust application that uses state snapshots opens a page whose embedded state_json holds authorization attributes, edits the unsigned JSON in their browser to set is_admin to True (or alter account_id/balance), and returns it in the reconnect mount frame during back-navigation. The server restores the forged snapshot as trusted view state, granting the attacker elevated privileges or letting them tamper with business state. No public exploit code was identified at time of analysis, but the manipulation requires only client-side editing of data already present in the page.