The djust library for Django with Rust-powered reactive server-side rendering had an insufficient verification of data authenticity vulnerability (CWE-345) in versions before 1.0.7. Views that enabled state snapshots embedded an unsigned JSON state in the client page, which was restored on reconnect without integrity checks. This allowed clients to modify the state JSON arbitrarily, such as changing 'is_admin' to true or altering account balances, leading to privilege escalation or business state tampering. The vulnerability is addressed in djust 1.0.7 by signing state snapshots and rejecting unsigned or forged snapshots during back-navigation restore.

An attacker can manipulate unsigned state snapshots to escalate privileges (e.g., gain admin rights) or alter sensitive business data like account balances. This compromises confidentiality and integrity of application state, potentially leading to unauthorized access and data tampering. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade to djust version 1.0.7 or later, where state snapshots are signed and unsigned or forged snapshots are rejected. As a temporary workaround, disable state snapshots and avoid storing authorization or ownership information in public view attributes to prevent privilege escalation or state tampering.