CVE-2026-115509

MEDIUM 4.2

Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

CWE	CWE-863
Vendor	jitsucom
Product	jitsu
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for jitsucom jitsu

Be the first to know when new medium vulnerabilities affecting jitsucom jitsu are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

jitsucom / jitsu

0 < 2.14.0-beta.41

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jitsucom/jitsu/issues/1242 github.com: https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3 github.com: https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41 github.com: https://github.com/jitsucom/jitsu vulncheck.com: https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-api

Credits

lighthousekeeper1212 🔍 leediay153 from Viettel Post