Access Control Flaw in Django Unicorn Component Functionality

CVE-2026-31815

What is CVE-2026-31815?

Prior to version 0.67.0, Django Unicorn contains a significant access control vulnerability that allows attackers to manipulate component states. The flaw arises from inadequate access control checks during property updates and method invocations, enabling unauthorized manipulation of internal attributes, including sensitive properties like template_name. Attackers may exploit this weakness to trigger protected methods improperly, leading to potential unauthorized actions within the application. This issue has been addressed in version 0.67.0, emphasizing the need for users to update their installations promptly to maintain security and integrity.

References