CVE-2026-115509

low

Description

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

References

https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-api

https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41

https://github.com/jitsucom/jitsu/issues/1242

https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3

https://github.com/jitsucom/jitsu

Details

Source: Mitre, NVD

Published: 2026-10-22

Updated: 2026-10-22

Risk Information

CVSS v2

Base Score: 3.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:N

Severity: Low

CVSS v3

Base Score: 4.2

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 2.3

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Low