Secuno
ENNL
Book demo

CVE-2026-61591

8.1 HIGH
  1. Published16 Sept 2026

Description

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-542398.8
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin…
CVE-2026-860398.2
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until…
CVE-2026-269508.1
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient…
CVE-2026-885929.1
kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The…
CVE-2026-631278.2
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp…
CVE-2026-734358.2
On affected platforms running Arista EOS with Open Shortest Path First version 2…

Frequently asked

Is CVE-2026-61591 being actively exploited?

CVE-2026-61591 is not in the CISA KEV catalog.

How severe is CVE-2026-61591?

CVE-2026-61591 has a CVSS 3.1 base score of 8.1, rated high.

How do I fix CVE-2026-61591?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-61591 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.