{"uuid": "88d616ce-5a01-4533-9386-d32b8251a657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61596", "type": "seen", "source": "https://gist.github.com/alon710/54d5caa66e0c608481afad4bb0bb44a6", "content": "# CVE-2026-61596: CVE-2026-61596: Broken Object-Level Access Control (IDOR) in djust Framework\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61596\n\n## Summary\nA broken object-level access control (IDOR) vulnerability exists in the djust Django framework prior to version 1.0.7. The framework's per-object authorization hooks were enforced correctly over WebSockets but entirely bypassed on synchronous HTTP GET rendering, SPA client-side navigation, and embedded sub-views, allowing authenticated attackers to view arbitrary unauthorized database records.\n\n## TL;DR\nThe djust framework omitted authorization checks on non-WebSocket rendering paths, allowing authenticated users to bypass object-level permissions and access sensitive records.\n\n## Technical Details\n\n- **CWE ID**: CWE-639, CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.1\n- **EPSS Score**: N/A\n- **Impact**: High (Confidentiality)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust framework\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or later.\n- Manually wrap vulnerable HTTP and template dispatch flows with authorization checks if immediate patching is unfeasible.\n\n**Remediation Steps:**\n1. Verify current djust installation version using pip.\n2. Execute update command to obtain version 1.0.7 or higher.\n3. Run the framework regression test suite to confirm the fix is correctly applied.\n\n## References\n\n- [GitHub Security Advisory GHSA-c7c5-5j6r-q957](https://github.com/djust-org/djust/security/advisories/GHSA-c7c5-5j6r-q957)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61596) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T09:32:22.646780Z"}