djust is a Django reactive server-side rendering tool using Rust for performance. Before version 1.0.7, the live WebSocket transport authorized views using check_view_auth, which did not enforce Django's standard authorization mechanisms such as LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, or method decorators on dispatch(). Consequently, authorization was enforced only on the initial HTTP GET request but silently bypassed on WebSocket connections where all events and state changes occur. This allowed unauthenticated or under-privileged users to open WebSocket connections and access or manipulate views, including administrative functions like list, create, change, or delete. The fix in version 1.0.7 ensures that check_view_auth respects Django's AccessMixin family on all transports, introduces a startup system check (S004) to detect unsafe auth patterns, and strengthens admin mixins with login and staff permission gates. Workarounds include using djust's login_required, permission_required, or check_permissions attributes that apply to all transports.

The vulnerability allows unauthenticated or unauthorized users to bypass critical authentication controls on WebSocket connections, potentially granting access to sensitive administrative views and operations. This can lead to unauthorized data access and modification, posing a high confidentiality and integrity risk. The CVSS 3.1 score of 9.1 reflects the critical nature of this flaw with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

A fixed version, djust 1.0.7, is available and should be applied to enforce proper authentication on all transports including WebSocket. The fix ensures that Django's AccessMixin authorization is honored and adds system checks to detect unsafe authentication patterns at startup. Until upgrading, developers should gate views using djust's login_required, permission_required, or check_permissions attributes, which are enforced on all transports, rather than relying on HTTP-only Django mixins or decorators.