Jitsucom

CVE-2026-115509: Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syn

CVE-2026-115509 Oct 22, 2026 Source: Vendor

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-115509

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines

Showing 1–2 of 2

CVE-2026-115509 BR2026-0000-031112 unclaimed

Credited as lighthousekeeper1212

CVE-2026-115509 BR2026-0000-031113 unclaimed

Credited as leediay153 from Viettel Post