djust EUVD-2026-80768

Exploitation requires that the target application (a) uses djust < 1.0.7 with a LiveView that inherits the default ModelBindingMixin (on by default across all LiveViews), (b) does NOT set allowed_model_fields (which defaults to None = allow all), and (c) stores security-relevant state - e.g. self.account_id, self.is_admin, self.total_price - as public, non-underscore view attributes not covered by the 14-entry FORBIDDEN_MODEL_FIELDS denylist. The attacker sends update_model events over the established WebSocket. Limiting factors: impact is high only when authorization/ownership/business logic reads these tamperable attributes without re-authorizing downstream; the target field must already exist (hasattr) and not be underscore-prefixed or on the denylist; for authenticated-only views a valid session is needed (PR:L), whereas public login-free views are exploitable anonymously (effectively PR:N). Setting allowed_model_fields to a minimal list, or upgrading to 1.0.7, closes it.

This is a genuine but conditionally-severe integrity vulnerability, not a hollow high-CVSS entry. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:N/VI:H/VA:N, score 7.1) is well-calibrated to a state-tampering/mass-assignment flaw: pure integrity impact (VI:H), no confidentiality or availability, network-reachable over WebSocket with low complexity and no user interaction. CWE-915 (mass assignment) matches the described behavior exactly. The vendor rates severity as 'High' only for apps that store authorization/ownership/business state in public view attributes (the normal djust pattern) and 'Low' otherwise, so real risk is app-dependent. Note a genuine PR ambiguity: the CVSS uses PR:L (authenticated), but the advisory explicitly states that for a public, no-login LiveView an anonymous client can mass-assign - so for those deployments PR:N is more accurate and effective severity would be higher. No EPSS score, no CISA KEV listing, and no public exploit are provided; the reproducer/writeup is retained privately by the reporter, so this is no public exploit identified at time of analysis. The default-on nature (the mixin is in every LiveView's base MRO) broadens exposure across all djust apps, but the niche footprint of the framework limits absolute scale.

An attacker connects to a djust LiveView over WebSocket and sends {type:event, event:"update_model", params:{field:"is_admin", value:"true"}}, exploiting the default update_model handler that setattrs any public, existing view attribute - even ones never bound with dj-model. With type coercion turning "true" into boolean True, they flip self.is_admin or overwrite self.account_id / self.total_price to tamper with authorization, ownership, or pricing state. No public exploit is published, but the vendor reproduced setting account_id/is_admin/total_price, none of which were dj-model-bound.