CVE-2026-61594

djust has an authorization bypass on the WebSocket/SSE mount path

Workarounds

Gate views using djust's login_required / permission_required / check_permissions attributes (honored on all transports) rather than HTTP-only mixins/decorators.

The live (WebSocket) transport authorizes a mount via check_view_auth, not Django's View.dispatch() chain. As a result, standard Django authorization, LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method_decorator(login_required, name="dispatch"), and custom dispatch() guards, and the djust admin extension's staff gate (applied only in the HTTP as_view wrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view, including admin list/create/change/delete, and dispatch its handlers.

A critical operation is accessible without requiring any authentication. Typical impact: any user can invoke the privileged function.

CVE-2026-61594 has a CVSS score of 9.1 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.7); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Fixed in djust 1.0.7. check_view_auth now honors the Django AccessMixin family on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-dispatch forms); and the admin base mixin declares login_required = True + an active-staff check_permissions gate.

1. What is CVE-2026-61594? CVE-2026-61594 is a critical-severity missing authentication for critical function vulnerability in djust (pip), affecting versions < 1.0.7. It is fixed in 1.0.7. A critical operation is accessible without requiring any authentication.
2. How severe is CVE-2026-61594? CVE-2026-61594 has a CVSS score of 9.1 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of djust are affected by CVE-2026-61594? djust (pip) versions < 1.0.7 is affected.
4. Is there a fix for CVE-2026-61594? Yes. CVE-2026-61594 is fixed in 1.0.7. Upgrade to this version or later.
5. Is CVE-2026-61594 exploitable, and should I be worried? Whether CVE-2026-61594 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-61594 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-61594? Upgrade djust to 1.0.7 or later.