CVE-2026-115509 — Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership che…
Published: 2026-10-22 · CVSS: 2.3 · CVSS 4.0
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7