CVE-2026-55571: CWE-285: Improper Authorization in djust-org djust

In djust versions before 1.0.4, when authorization checks such as login_required or permission_required fail during a LiveView mount, the system sends a redirect frame but does not close the WebSocket connection or clear the view instance. A browser client follows the redirect, but a raw WebSocket client can ignore it and maintain the mounted socket. Since LiveViewConsumer.handle_event does not revalidate authentication or authorization, the client can send event frames that invoke event handler methods without an authenticated session. This can lead to unauthorized access to sensitive data or unauthorized mutations. The issue is addressed in djust version 1.0.4.

An attacker using a raw WebSocket client can bypass authentication and authorization checks to invoke event handlers that should require a valid session. This can result in unauthorized sensitive information disclosure and unauthorized data modifications. The CVSS score of 8.2 reflects a high severity with low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity without affecting availability.

Upgrade to djust version 1.0.4 or later, where this improper authorization issue is fixed. No other mitigation steps are indicated or required according to the available data.