Privilege Escalation Vulnerability in djust by djust-org
CVE-2026-61591

8.1HIGH

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61591?

The djust framework, which offers Phoenix LiveView-style reactive server-side rendering for Django, has a vulnerability in versions before 1.0.7. This flaw affects views that use state snapshots, allowing a client to modify the embedded state_json without any integrity checks. By manipulating this unsigned state_json, an attacker could inject arbitrary view attributes, leading to unauthorized privilege elevation—such as toggling is_admin to True or altering user-specific details like account_id or balance. This security issue has been addressed in version 1.0.7 by implementing signing for state snapshots, which now reject any unsigned or tampered snapshots during session restorations. Users are advised to avoid enabling state snapshots and not to include sensitive authorization details in publicly accessible view attributes.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.