CVE-2026-61595

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-61595

djust prior to 1.0.7 provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Multi-tenant isolation was enforced only on the HTTP path: the current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware. On the...

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Impact djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path getcurrenttenant was always None during mount and every event handler — and the tenant-aware...