Medium 4.2

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources...

CVE-2026-115509 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
jitsucom	jitsu	< 2.14.0-beta.41	2.14.0-beta.41

Original description The description as published by the source.

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.2; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4: Low 2.3; CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-vfq9-5jrr-qr65
CWE: CWE-863

NVD GitHub Advisory

Tags(click for explanation)

CWE

Cwe 863

All

Jitsucom Jitsu

Detection sources

NIST National Vulnerability Database05:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14