Executive brief
djust is a Python web framework for building interactive views. A critical flaw allowed authenticated users to view and modify sensitive data that they should not have access to by exploiting gaps in object-level permission checks. Attackers could access unauthorized information by navigating directly to pages, using the application's SPA navigation, or embedding protected views within other pages. This exposes confidential data and enables unauthorized modifications to customer or business records.
Technical details
This is a classic insecure direct object reference (IDOR) / broken object-level access control vulnerability (CWE-639, CWE-862). djust implements per-object authorization via `get_object` and `has_object_permission` methods that were correctly enforced on WebSocket mount and event paths, but were bypassed on three HTTP render entry points: initial HTTP GET requests, SPA url_change navigation events, and embedded `{% live_render %}` child views. An authenticated attacker can access an object by directly requesting its URL, navigating via SPA, or composing it as an embedded view without triggering permission checks. The attack requires valid authentication but no user interaction. Fixed in djust 1.0.7 by routing all render entry points through a unified `enforce_object_permission` guard that returns 403 on direct HTTP access, blocks url_change navigation, and refuses embedded composition for unauthorized objects.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: Fixed in djust 1.0.7