{"id":"CVE-2026-115509","kind":"vulnerability","aliases":["CVE-2026-115509"],"related":[],"title":"Jitsu console: missing await lets users alter other workspaces' sync cursors","description":"Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.","summary":"In the Jitsu console, state handlers call findFirst without await, so the syncId ownership check never rejects a request. An authenticated user who knows another workspace's sync ID can read, overwrite or delete that workspace's stream cursors, causing data to be re-ingested or skipped.","severity":"medium","cvss":4.2,"epss":0.00169,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-pipelines","jitsu","package","self-hosted"],"not_affected_if":["managed-hosting","single-workspace"],"how_to_check":"- Check the installed Jitsu console version; unknown whether the sources give an exact command.\n- Look at sources/state.ts in the console code for handlers that call findFirst without await.","fix":"- Upgrade the Jitsu console to `2.14.0-beta.41` or later.","status":"open","published_at":"2026-10-22T20:17:07+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:41:24+00:00","updated_at":"2026-10-25T04:41:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:41:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Jitsu console to `2.14.0-beta.41` or later.","reach":"internet","title":"Jitsu console: missing await lets users alter other workspaces' sync cursors","impact":"medium","summary":"In the Jitsu console, state handlers call findFirst without await, so the syncId ownership check never rejects a request. An authenticated user who knows another workspace's sync ID can read, overwrite or delete that workspace's stream cursors, causing data to be re-ingested or skipped.","category":"package","nicknames":[],"who_cares":["jitsu","self-hosted","data-pipelines"],"confidence":0.6,"needs_auth":"yes","worst_case":"Another workspace's sync cursors are read, overwritten or deleted by a logged-in user.","analyst_note":"","how_to_check":"- Check the installed Jitsu console version; unknown whether the sources give an exact command.\n- Look at sources/state.ts in the console code for handlers that call findFirst without await.","needs_analyst":false,"not_affected_if":["single-workspace","managed-hosting"],"who_is_affected":"Teams running a self-hosted Jitsu console with multiple workspaces or users who share the console. The flaw needs an authenticated account and knowledge of another workspace's sync ID. Single-tenant installs with one trusted user have little exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00059,"input_tokens":3383,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115509':14A,17A '-2026':13A,16A '2.14.0':77C 'alter':7A 'anoth':50B,102C 'authent':46B,99C 'author':82C 'await':4A,35B,91C 'beta.41':78C 'call':32B,88C 'caus':65B,115C 'check':40B,96C 'consol':2A,29B,75C 'contain':79C 'cursor':11A,64B,114C 'cve':12A,15A 'data':19B,66B,116C,122C 'data-pipelin':18B 'delet':59B,111C 'fail':98C 'findfirst':33B,89C 'handler':31B,86C 'host':25B 'id':54B,106C 'incorrect':81C 'ingest':71B,119C 'jitsu':1A,21B,28B,74C 'know':49B,101C 'let':5A 'miss':3A 'never':41B,97C 'overwrit':57B,109C 'ownership':39B,95C 'packag':22B 'pipelin':20B 're':70B,118C 're-ingest':69B,117C 'read':56B,108C 'reject':42B 'request':44B 'self':24B 'self-host':23B 'skip':73B,121C 'sources/state.ts':85C 'state':30B 'stream':63B,113C 'sync':10A,53B,105C 'syncid':38B,94C 'user':6A,47B,100C 'vulner':83C 'without':34B,90C 'workspac':9A,51B,61B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Jitsu console with multiple workspaces or users who share the console. The flaw needs an authenticated account and knowledge of another workspace's sync ID. Single-tenant installs with one trusted user have little exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T20:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115509","severity":null,"published_at":"2026-10-22T20:17:07+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115509","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115509","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}