djust CVE-2026-61595

Exploitation requires a djust application older than 1.0.7 that uses the djust.tenants multi-tenancy feature AND serves data over the live path (WebSocket or SSE / LiveView-style dispatch). The attacker must be able to establish a live socket to the app (PR:L - a valid session/authenticated tenant user), after which every mount and event handler runs with get_current_tenant()==None and the manager returns unfiltered, cross-tenant data. Limiting factors: the flaw only manifests on the WS/SSE path (pure HTTP requests remained correctly tenant-scoped), the app must actually rely on djust's tenant-aware QuerySet managers for isolation, and the shared threading.local on the sync_to_async executor thread can also leak one connection's tenant into another. The vendor states there is NO workaround on the live path short of upgrading to 1.0.7; disabling STRICT_MODE does not help since the live path ignored STRICT_MODE and failed open regardless.

This is a genuine, high-priority tenant-isolation flaw rather than an inflated high-CVSS finding, though the raw score should be read carefully. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7) is internally consistent with the description: network-reachable, low complexity, requires low privileges (a valid socket/session), no user interaction, and a scope change (S:C) because one tenant's socket reads OTHER tenants' data. The C:H / I:N / A:N split correctly reflects a pure confidentiality (data-disclosure) issue with no integrity or availability impact - matching the 'Information Disclosure' tag and CWE-636 (Not Failing Securely / fail-open). No EPSS score, no CISA KEV entry, and no public exploit code are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals is expected for a freshly disclosed flaw in a small package and does not lower the underlying severity. The one signal that tempers real-world urgency is deployment footprint: djust is an obscure niche framework, so this is a serious bug in a low-prevalence product, meaning aggregate internet-wide risk is modest even though per-deployment impact (full cross-tenant data disclosure) is severe. No data conflicts were detected between the CVSS vector and the narrative - both agree the flaw is remote, low-privilege, confidentiality-only, and scope-changing.

A legitimate low-privilege user of one tenant on a multi-tenant djust application opens a WebSocket or SSE 'live' connection. Because the current tenant is never bound on the live path, get_current_tenant() returns None and the tenant-aware manager fails open, returning the unfiltered queryset, so the attacker's event handlers read and receive rows belonging to every other tenant. No public exploit code is identified at time of analysis, but exploitation requires no special tooling - only interacting with the live views over an authenticated socket.