What’s Vulnerable › Vulnerabilities

CVE-2026-115509: Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-29
• Weakness: CWE-863

Description

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

Affected products

• jitsucom jitsu: before 2.14.0-beta.41 — fixed in 2.14.0-beta.41

How to fix

Upgrade to a fixed version: jitsucom jitsu 2.14.0-beta.41. Check the vendor advisory for mitigations.

References

• https://github.com/jitsucom/jitsu
• https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3
• https://github.com/jitsucom/jitsu/issues/1242
• https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41
• https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-api

Get alerted when CVE-2026-115509 or the next vulnerability affects your stack