Vulnerability PYSEC-2026-4036

High Risk

20 days ago

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

0.1.0 - 1.0.6

Summary

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Details

Impact

djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware, so on the live (WebSocket/SSE) path get_current_tenant() was always None during mount and every event handler — and the tenant-aware QuerySet manager failed OPEN (returned the unfiltered queryset, ignoring STRICT_MODE), disclosing every tenant's rows to whoever held the socket. threading.local was additionally shared across connections on the sync_to_async executor thread.

Patches

Fixed in djust 1.0.7. Tenant storage moved to a contextvars.ContextVar (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (.none() under the default STRICT_MODE); and system check S006 warns when STRICT_MODE=False.