Live › vulnerability › CVE-2026-115509
Go to dashboardIn the Jitsu console, state handlers call findFirst without await, so the syncId ownership check never rejects a request. An authenticated user who knows another workspace's sync ID can read, overwrite or delete that workspace's stream cursors, causing data to be re-ingested or skipped.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a self-hosted Jitsu console with multiple workspaces or users who share the console. The flaw needs an authenticated account and knowledge of another workspace's sync ID. Single-tenant installs with one trusted user have little exposure.
No product ranges from the sources yet.
2.14.0-beta.41 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
This page as .md · .json · in your agent: get_signal("CVE-2026-115509")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.