djust, a Django reactive server-side rendering tool with Rust performance, had a security flaw before version 1.0.7 where its per-object authorization was enforced only on WebSocket mount and event paths but not on three other render entry points: the initial HTTP GET render, SPA url_change navigation, and {% live_render %} embedded child views. This allowed authenticated users to bypass authorization and view or act on unauthorized objects, constituting an IDOR and broken object-level access control vulnerability. The fix in 1.0.7 routes all render entry points through a shared enforce_object_permission chokepoint, returning HTTP 403 or permission_denied frames as appropriate. Views without custom get_object methods are unaffected. No reliable workaround exists except upgrading.

An authenticated user could access or perform limited actions on objects they are not authorized to view or modify by exploiting unprotected render entry points. This leads to unauthorized information disclosure (high confidentiality impact) and limited integrity impact. Availability is not affected. The vulnerability affects object-scoped views exposed via HTTP GET, SPA url_change, and live_render paths.

Upgrade djust to version 1.0.7 or later, where the vulnerability is fixed by enforcing authorization checks on all render entry points. Until patched, do not expose object-scoped views through HTTP GET, SPA url_change, or live_render paths. No reliable workaround exists other than upgrading.