[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-61594":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-17T07:07:30.415Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":256,"aliases":257,"duplicate_of":9,"upstream":259,"downstream":260,"duplicates":261,"related":262,"reserved_at":9,"published_at":263,"modified_at":263,"state":264,"summary":265,"references_raw":272,"kevs":291,"epss":9,"epss_history":292,"metrics":293,"affected":303},"CVE-2026-61594","djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name=\"dispatch\")`, and custom `dispatch()` guards — and the djust admin extension's staff gate (applied only in the HTTP `as_view` wrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view — including admin list/create/change/delete — and dispatch its handlers. This is fixed in djust 1.0.7. `check_view_auth` now honors the Django `AccessMixin` family on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-`dispatch` forms); and the admin base mixin declares `login_required = True` + an active-staff `check_permissions` gate. As a workaround, gate views using djust's `login_required` / `permission_required` / `check_permissions` attributes (honored on all transports) rather than HTTP-only mixins/decorators.",null,[11,40],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-306","Missing Authentication for Critical Function","The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","weakness","Draft","Base","High",[20,24,28,32,36],{"id":21,"name":22,"techniques":23},"CAPEC-12","Choosing Message Identifier",[],{"id":25,"name":26,"techniques":27},"CAPEC-166","Force the System to Reset Values",[],{"id":29,"name":30,"techniques":31},"CAPEC-216","Communication Channel Manipulation",[],{"id":33,"name":34,"techniques":35},"CAPEC-36","Using Unpublished Interfaces or Functionality",[],{"id":37,"name":38,"techniques":39},"CAPEC-62","Cross Site Request Forgery",[],{"_key":41,"id":41,"name":42,"description":43,"type":15,"status":44,"abstraction":45,"likelihood_of_exploit":18,"capec":46},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","Incomplete","Class",[47],{"id":48,"name":49,"techniques":50},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[51,88,128],{"id":52,"name":53,"tactics":54,"countermeasures":61},"T1211","Exploitation for Stealth",[55,58],{"id":56,"name":57},"TA0030","Defense Evasion",{"id":59,"name":60},"TA0005","Stealth",[62,67,72,76,80,84],{"id":63,"name":64,"tactic":65},"D3-PSEP","Process Segment Execution Prevention",{"name":66},"Harden",{"id":68,"name":69,"tactic":70},"D3-MBT","Memory Boundary Tracking",{"name":71},"Detect",{"id":73,"name":74,"tactic":75},"D3-PCSV","Process Code Segment Verification",{"name":71},{"id":77,"name":78,"tactic":79},"D3-SFCV","Stack Frame Canary Validation",{"name":66},{"id":81,"name":82,"tactic":83},"D3-SSC","Shadow Stack Comparisons",{"name":71},{"id":85,"name":86,"tactic":87},"D3-SAOR","Segment Address Offset Randomization",{"name":66},{"id":89,"name":90,"tactics":91,"countermeasures":97},"T1542.002","Component Firmware",[92,93,94],{"id":56,"name":57},{"id":59,"name":60},{"id":95,"name":96},"TA0110","Persistence",[98,102,106,110,114,119,124],{"id":99,"name":100,"tactic":101},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":71},{"id":103,"name":104,"tactic":105},"D3-FV","Firmware Verification",{"name":71},{"id":107,"name":108,"tactic":109},"D3-FBA","Firmware Behavior Analysis",{"name":71},{"id":111,"name":112,"tactic":113},"D3-SU","Software Update",{"name":66},{"id":115,"name":116,"tactic":117},"D3-SWI","Software Inventory",{"name":118},"Model",{"id":120,"name":121,"tactic":122},"D3-RS","Restore Software",{"name":123},"Restore",{"id":125,"name":126,"tactic":127},"D3-AVE","Asset Vulnerability Enumeration",{"name":118},{"id":129,"name":130,"tactics":131,"countermeasures":140},"T1556","Modify Authentication Process",[132,133,136,137],{"id":56,"name":57},{"id":134,"name":135},"TA0112","Defense Impairment",{"id":95,"name":96},{"id":138,"name":139},"TA0031","Credential Access",[141,146,150,155,159,163,167,171,175,179,183,187,191,195,200,204,208,212,216,220,224,228,232,236,240,244,248,252],{"id":142,"name":143,"tactic":144},"D3-LFP","Local File Permissions",{"name":145},"Isolate",{"id":147,"name":148,"tactic":149},"D3-HBPI","Hardware-based Process Isolation",{"name":145},{"id":151,"name":152,"tactic":153},"D3-FEV","File Eviction",{"name":154},"Evict",{"id":156,"name":157,"tactic":158},"D3-HS","Host Shutdown",{"name":154},{"id":160,"name":161,"tactic":162},"D3-PSMD","Process Self-Modification Detection",{"name":71},{"id":164,"name":165,"tactic":166},"D3-CQ","Content Quarantine",{"name":145},{"id":168,"name":169,"tactic":170},"D3-ABPI","Application-based Process Isolation",{"name":145},{"id":172,"name":173,"tactic":174},"D3-SFA","System File Analysis",{"name":71},{"id":176,"name":177,"tactic":178},"D3-PT","Process Termination",{"name":154},{"id":180,"name":181,"tactic":182},"D3-SCF","System Call Filtering",{"name":145},{"id":184,"name":185,"tactic":186},"D3-AM","Access Modeling",{"name":118},{"id":188,"name":189,"tactic":190},"D3-RC","Restore Configuration",{"name":123},{"id":192,"name":193,"tactic":194},"D3-FE","File Encryption",{"name":66},{"id":196,"name":197,"tactic":198},"D3-DF","Decoy File",{"name":199},"Deceive",{"id":201,"name":202,"tactic":203},"D3-FIM","File Integrity Monitoring",{"name":71},{"id":205,"name":206,"tactic":207},"D3-CF","Content Filtering",{"name":145},{"id":209,"name":210,"tactic":211},"D3-FA","File Analysis",{"name":71},{"id":213,"name":214,"tactic":215},"D3-WSAM","Web Session Access Mediation",{"name":145},{"id":217,"name":218,"tactic":219},"D3-CI","Configuration Inventory",{"name":118},{"id":221,"name":222,"tactic":223},"D3-RF","Restore File",{"name":123},{"id":225,"name":226,"tactic":227},"D3-PSA","Process Spawn Analysis",{"name":71},{"id":229,"name":230,"tactic":231},"D3-PLA","Process Lineage Analysis",{"name":71},{"id":233,"name":234,"tactic":235},"D3-RFAM","Remote File Access Mediation",{"name":145},{"id":237,"name":238,"tactic":239},"D3-CM","Content Modification",{"name":145},{"id":241,"name":242,"tactic":243},"D3-NTPM","Network Traffic Policy Mapping",{"name":118},{"id":245,"name":246,"tactic":247},"D3-KBPI","Kernel-based Process Isolation",{"name":145},{"id":249,"name":250,"tactic":251},"D3-PS","Process Suspension",{"name":154},{"id":253,"name":254,"tactic":255},"D3-HR","Host Reboot",{"name":154},[],[258],"GHSA-xhhm-f6hp-2qwj",[],[],[],[],"2026-09-16T21:59:01.907Z","Received",{"cisa_kev":266,"cisa_ransomware":266,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":267,"severity_score":268,"severity_version":269,"severity_source":270,"severity_vector":271,"severity_status":264},false,"critical",9.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",[273,281,286],{"url":274,"sources":275,"tags":278},"https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj",[270,276,277],"nvd","osv_pypi",[279,280],"X Refsource CONFIRM","WEB",{"url":282,"sources":283,"tags":284},"https://github.com/djust-org/djust/releases/tag/v1.0.7",[270,276,277],[285,280],"X Refsource MISC",{"url":287,"sources":288,"tags":289},"https://github.com/djust-org/djust",[277],[290],"PACKAGE",[],[],[294,299,301],{"source":270,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":295,"cvss_v4_0":9},{"baseScore":268,"baseSeverity":296,"vectorString":271,"impactScore":297,"exploitabilityScore":298},"CRITICAL",8.7,10,{"source":276,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":300,"cvss_v4_0":9},{"baseScore":268,"baseSeverity":296,"vectorString":271,"impactScore":297,"exploitabilityScore":298},{"source":277,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":302,"cvss_v4_0":9},{"baseScore":268,"baseSeverity":9,"vectorString":271,"impactScore":297,"exploitabilityScore":298},[304,314],{"ecosystem":9,"name":305,"vendor":306,"product":305,"cpe_part":307,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":308},"djust","djust-org","a",[309],{"version":310,"is_range":311,"range_type":270,"version_start":9,"version_start_type":9,"version_end":312,"version_end_type":313,"fixed_in":9},"\u003C 1.0.7",true,"1.0.7","excluding",{"ecosystem":315,"name":305,"vendor":315,"product":305,"cpe_part":9,"purl_type":316,"purl_namespace":9,"purl_name":305,"source":9,"versions":317},"PyPI","pypi",[318],{"version":319,"is_range":311,"range_type":320,"version_start":9,"version_start_type":9,"version_end":312,"version_end_type":313,"fixed_in":9},"lt1_0_7","ecosystem"]