EUVD-2026-81305
GHSA-c7c5-5j6r-q957
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-reachable, low-complexity IDOR requiring any authenticated account (PR:L); high confidentiality from viewing unauthorized objects, low integrity since some paths permit acting on them, no availability impact.
Primary rating from Vendor (https://github.com/djust-org/djust).
CVSS VectorVendor: https://github.com/djust-org/djust
Lifecycle Timeline
6DescriptionCVE.org
Impact
djust's per-object authorization (get_object + has_object_permission, ADR-017) was enforced on the WebSocket mount and event paths but not on three other render entry points: (a) the initial HTTP GET render, (b) SPA url_change navigation, and (c) {% live_render %} embedded child views. An authenticated user could therefore view (and on some paths act on) an object they are not authorized for by loading the page directly, navigating to it via SPA url-change, or composing it as an embedded child - a classic IDOR / broken object-level access control on object-scoped views.
Patches
Fixed in djust 1.0.7. All render entry points now route through a shared enforce_object_permission chokepoint: HTTP GET returns 403, url_change emits a permission_denied frame and skips the render, and {% live_render %} (eager + lazy) refuses the embed. Views without a custom get_object are unaffected (no-op).
Workarounds
No reliable workaround short of upgrading. Do not expose object-scoped views through the HTTP-GET / url_change / live_render paths until patched.
AnalysisAI
Broken object-level access control in djust before 1.0.7 lets an authenticated user view - and on some paths act on - object-scoped views they are not authorized for, by loading the page via a direct HTTP GET, navigating to it through SPA url_change, or embedding it as a {% live_render %} child (eager or lazy). The flaw exists because per-object authorization (get_object plus has_object_permission, ADR-017) was enforced only on the WebSocket mount and event paths, leaving these three render entry points unchecked; views that do not define a custom get_object are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated djust application user (PR:L) and a view that defines a custom get_object (object-scoped view) - views without a custom get_object are explicitly unaffected (no-op). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority authorization flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to djust 1.0.7 or later - the vendor-released patch (fixed version 1.0.7) routes HTTP GET, SPA url_change, and {% live_render %} (eager and lazy) through the shared enforce_object_permission chokepoint, returning 403 on HTTP GET, emitting a permission_denied frame and skipping the render on url_change, and refusing the embedded child embed; see https://github.com/djust-org/djust/security/advisories/GHSA-c7c5-5j6r-q957 and the release at https://github.com/djust-org/djust/releases/tag/v1.0.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all djust deployments to identify any version older than 1.0.7 that exposes object-scoped views through direct HTTP GET, SPA url_change, or {% live_render %} child rendering, and immediately require custom get_object plus has_object_permission on every affected view while disabling {% live_render %} child rendering and SPA url_change navigation to those views. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today