Medium severity4.2NVD Advisory· Published Oct 22, 2026
CVE-2026-115509
CVE-2026-115509
Description
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3nvd
- github.com/jitsucom/jitsu/issues/1242nvd
- github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41nvd
- www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-apinvd
News mentions
0No linked articles in our index yet.