Executive brief
djust is a Django framework for building real-time, multi-tenant web applications. A security flaw in its tenant isolation logic allows authenticated users connected via WebSocket or SSE to view confidential data belonging to other customers or organizations in the same system. The application was designed to properly isolate tenant data on regular HTTP requests, but failed to enforce this protection on live connections, risking exposure of sensitive customer data and potential regulatory compliance violations.
Technical details
The vulnerability is a missing authorization / failing-open issue (CWE-636, CWE-862) in the djust tenant isolation layer. The root cause: tenant context was stored in `threading.local()` and set only by the HTTP-only `TenantMiddleware`, so WebSocket and SSE handlers received `None` as the current tenant. The tenant-aware `QuerySet` manager then failed open—returning unfiltered querysets regardless of `STRICT_MODE` setting—disclosing every tenant's database rows. Additionally, `threading.local` storage was shared across connections on the `sync_to_async` executor thread, compounding the cross-tenant data leak. Attack requires an authenticated user to establish a WebSocket or SSE connection. Fix (v1.0.7) moved tenant storage to `contextvars.ContextVar` (properly isolated per async task), bound tenant resolution around each mount and dispatch call, and made managers fail closed (`.none()` under default `STRICT_MODE`) when tenant cannot be determined.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed: Advisory published
- 2026-06-22: patched: Fixed in djust 1.0.7
- 2026-09-16: advisory: GitHub Advisory Database publication