Every CVE Search/ Get API key

CVE-2026-61591

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

8.1 HighFix available

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.22%Up 0.1 points since Sep 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Record
CVE-2026-61591
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345, CWE-915
Updated
2026-11-02
EUVDEUVD-2026-81302 8.1

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Record
EUVD-2026-81302
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c67v-vqrp-m5wj 8.1

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Impact

For views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).

Patches

Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.

Workarounds

Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Record
GHSA-c67v-vqrp-m5wj
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345, CWE-915
Updated
2026-11-02
NVD 8.1

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Record
CVE-2026-61591
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345, CWE-915
Updated
2026-11-02
OSV 8.1

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Record
CVE-2026-61591
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345, CWE-915
Updated
2026-11-02
OSVGHSA-c67v-vqrp-m5wj 8.1

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Impact

For views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).

Patches

Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.

Workarounds

Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Record
GHSA-c67v-vqrp-m5wj
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345, CWE-915
Updated
2026-11-02
OSVPYSEC-2026-4040 8.1

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Impact

For views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).

Patches

Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.

Workarounds

Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Record
PYSEC-2026-4040
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
djust
PyPI
 before 1.0.7
1.0.7
djust
PyPI
 before 1.0.7, plus listed versions
0.1.00.1.20.1.30.1.40.1.5
Show 45 moreShow less
0.1.60.1.70.1.80.1.90.2.00.2.10.2.20.3.00.3.10.3.20.3.40.3.50.3.60.3.70.3.80.4.00.4.10.4.20.4.30.4.40.9.00.9.10.9.20.9.40.9.50.9.60.9.71.0.01.0.0rc11.0.0rc101.0.0rc111.0.0rc121.0.0rc131.0.0rc141.0.0rc151.0.0rc161.0.0rc171.0.0rc181.0.0rc21.0.0rc31.0.0rc41.0.0rc61.0.0rc71.0.0rc81.0.0rc9
1.0.7
djust
PyPI
 before 1.0.7, plus listed versions
0.1.00.1.20.1.30.1.40.1.5
Show 35 moreShow less
0.1.60.1.70.1.80.1.90.2.00.2.10.2.20.3.00.3.10.3.20.3.40.3.50.3.60.3.70.3.80.4.00.4.10.4.20.4.30.4.40.9.00.9.10.9.20.9.40.9.50.9.60.9.71.0.01.0.0rc111.0.11.0.21.0.31.0.41.0.51.0.6
1.0.7

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-61591 is a high vulnerability (CVSS 8.1) in Djust-org Djust, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in djust 1.0.7.

References

This page doesn't list everything

Left out here: 18 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open