CVE-2026-61595: djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware, so on the live (WebSocket/SSE) path get_current_tenant() was always None during mount and every event handler — and the tenant-aware QuerySet manager failed OPEN (returned the unfiltered queryset, ignoring STRICT_MODE), disclosing every tenant’s rows to whoever held the socket. threading.local was additionally shared across connections on the sync_to_async executor thread.