djust CVE-2026-61594

Exploitable only when a djust live view (djust < 1.0.7) is protected using HTTP-only Django authorization - LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method_decorator(login_required, name="dispatch"), a custom overridden dispatch() guard, or the djust admin extension's staff gate applied in the HTTP as_view wrapper. Those guards run on the initial HTTP GET but are silently skipped on the WebSocket/SSE mount path, so an anonymous or under-privileged client reaches the same view over WebSocket. The exploitation LIMITER is the auth pattern: applications that gate views with djust's transport-agnostic login_required / permission_required / check_permissions attributes are NOT affected. Otherwise no authentication, privileges, or user interaction is required, and the vector is remote (network WebSocket).

This is a genuine high-priority authorization/authentication bypass. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) is internally consistent with the description: an anonymous, network-based client can open a WebSocket, mount a djust live view - including admin list/create/change/delete - and dispatch its handlers, yielding both confidentiality and integrity impact with no privileges or user interaction. The core signals align rather than conflict: CWE-306 (missing authentication for a critical function), PR:N, and the vendor's own account of a 'silent bypass' all point the same direction. Tempering the raw score: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code was supplied - so there is no evidence of active or automated exploitation, and the real-world blast radius is bounded by the small deployment footprint of djust. The bug is also conditional (see exploitation_conditions): it only bites applications that gate live views with HTTP-only Django mixins/decorators or the djust admin extension, not those already using djust's transport-agnostic auth attributes. Net: architecturally severe and trivially exploitable where present, but exploitation is opportunistic/targeted rather than mass-scale given the niche product.

An unauthenticated attacker who knows a target site runs djust (< 1.0.7) with a live view protected only by Django's LoginRequiredMixin/PermissionRequiredMixin or the djust admin staff gate opens a WebSocket to that view's mount endpoint. Because the WebSocket transport authorizes via check_view_auth instead of Django's View.dispatch() chain, the HTTP-only guard is skipped, and the attacker mounts the admin change/delete view and dispatches handlers to read or modify records. No public proof-of-concept was provided in the intelligence, so exploitation would require reproducing the mount flow from the advisory.