The vulnerability CVE-2026-61590 in djust prior to version 1.0.7 involves missing authentication for critical functions exposed via observability endpoints. These endpoints reveal live view and session state and provide a remote method invocation interface (`eval_handler`). The documented setup omits the opt-in middleware that restricts access to localhost, and the views themselves only enforce access when DEBUG mode is enabled. In this misconfigured scenario, a remote attacker can read sensitive application state and invoke handlers remotely. The fix in version 1.0.7 enforces localhost restrictions within the views and restricts access to the eval_handler endpoint, returning non-disclosing responses to unauthorized requests.

An attacker who can access the observability endpoints remotely in affected versions can read live application state and invoke remote handlers without authentication. This leads to high confidentiality and integrity impact, as sensitive data can be exposed and unauthorized commands executed. Availability impact is not affected. The vulnerability requires network access but has a high impact due to the sensitive nature of the exposed functions.

Upgrade djust to version 1.0.7 or later where the vulnerability is fixed. Ensure that DEBUG mode is set to False in production environments. Do not expose observability endpoints to untrusted networks. If upgrading is not immediately possible, verify that the localhost restriction middleware is properly installed and configured to restrict access to observability endpoints.