Vulnerability Description
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/jitsucom/jitsu
- https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb
- https://github.com/jitsucom/jitsu/issues/1242
- https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41
- https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-w
FAQ
What is CVE-2026-115509?
CVE-2026-115509 is a vulnerability with a CVSS score of 4.2 (MEDIUM). Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authent...
How severe is CVE-2026-115509?
CVE-2026-115509 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-115509?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.