Threats tagged 'ghsa-c7c5-5j6r-q957'

CVE-2026-61596 is an authorization bypass vulnerability in djust prior to version 1.0.7. The flaw allows authenticated users to view or act on objects they are not authorized for via certain render entry points that did not enforce per-object authorization. This includes the initial HTTP GET render, SPA url_change navigation, and embedded child views using {% live_render %}. The issue is fixed in version 1.0.7 by routing all render entry points through a shared permission enforcement chokepoint. No reliable workaround exists other than upgrading.