Djust-org Djust vulnerabilities

• djust-org djust djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool CVE-2026-113731 Fix available 3.3 LowOctober 20, 2026
• djust-org djust djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path CVE-2026-61599 Fix available 8.8 HighSeptember 16, 2026
• djust-org djust djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path CVE-2026-61589 Fix available 6.3 MediumSeptember 16, 2026
• djust-org djust djust has broken object-level access control (IDOR) CVE-2026-61596 Fix available 7.1 HighSeptember 16, 2026
• djust-org djust djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client CVE-2026-61588 Fix available 6.5 MediumSeptember 16, 2026
• djust-org djust djust has an authorization bypass on the WebSocket/SSE mount path CVE-2026-61594 Fix available 9.1 CriticalSeptember 16, 2026
• djust-org djust djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) CVE-2026-61591 Fix available 8.1 HighSeptember 16, 2026
• djust-org djust djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) CVE-2026-61592 Fix available 7.4 HighSeptember 16, 2026
• djust-org djust djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags CVE-2026-61597 Fix available 5.1 MediumSeptember 16, 2026
• djust-org djust djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session CVE-2026-61593 Fix available 8.1 HighSeptember 16, 2026
• djust-org djust djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data CVE-2026-61595 Fix available 7.7 HighSeptember 16, 2026
• djust-org djust Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler CVE-2026-61598 Fix available 7.1 HighSeptember 16, 2026
• djust-org djust djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG CVE-2026-61590 Fix available 7.4 HighSeptember 16, 2026
• djust-org djust djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls CVE-2026-55571 Fix available 8.2 HighAugust 25, 2026