{"uuid": "220d3153-8a4d-4785-9e79-04caa8b52260", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61595", "type": "seen", "source": "https://gist.github.com/alon710/add36254cc8a2aecb663b59914ea2d7d", "content": "# CVE-2026-61595: CVE-2026-61595: Multi-Tenancy Isolation Bypass on WebSocket and SSE Paths in djust\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61595\n\n## Summary\nThe multi-tenant isolation mechanism in djust prior to version 1.0.7 fails open on active WebSocket and Server-Sent Events (SSE) connections. Because the tenant context is stored in thread-local variables and initialized exclusively via HTTP middleware, asynchronous event loops executing ASGI/WebSocket code paths do not carry the resolved tenant identifier. When queries are executed without this context, the default database manager fails open, allowing authenticated users of any tenant to query and read sensitive rows across all other tenant accounts.\n\n## TL;DR\nPrior to version 1.0.7, djust does not enforce multi-tenancy boundaries on WebSocket and SSE connection paths. Thread-local context storage is not preserved across ASGI async tasks, leading to an uninitialized tenant ID that defaults to returning unfiltered, global database results to authenticated users.\n\n## Technical Details\n\n- **CWE ID**: CWE-636 / CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.7\n- **Impact**: High (Confidentiality)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust.tenants\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade the djust library dependency to version 1.0.7 or newer\n- Verify that DJUST_STRICT_MODE is configured to True in Django settings\n- Implement Django system checks to verify context-aware query boundaries\n\n**Remediation Steps:**\n1. Modify your project requirements file to require djust>=1.0.7\n2. Execute pip install -r requirements.txt or run pip install --upgrade djust>=1.0.7\n3. Add 'DJUST_STRICT_MODE': True to settings.py inside the DJUST_TENANTS configuration block\n4. Run python manage.py check on development and staging environments to identify system configuration warnings matching code S006\n\n## References\n\n- [Official Advisory (GHSA-3492-cvg7-9mr2)](https://github.com/djust-org/djust/security/advisories/GHSA-3492-cvg7-9mr2)\n- [Release Tag v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61595) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T19:33:34.440039Z"}