Threats tagged 'ghsa-v9rj-xjfv-xj9r'

CVE-2026-61589 affects djust versions prior to 1.0.7 and involves incorrect tenant resolution due to the use of a less trusted source for the HTTP host in WebSocket request reconstruction. This causes tenant-scoped data managers to either return unscoped data (cross-tenant data disclosure) when STRICT_MODE is false or empty querysets when STRICT_MODE is true. The issue is fixed in version 1.0.7 by properly extracting and validating the Host header from the ASGI scope against ALLOWED_HOSTS.