---
id: "CVE-2026-115509"
kind: "vulnerability"
aliases: ["CVE-2026-115509"]
title: "Jitsu console: missing await lets users alter other workspaces' sync cursors"
severity: "medium"
cvss: 4.2
epss: 0.00169
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["data-pipelines", "jitsu", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "single-workspace"]
published_at: "2026-10-22T20:17:07+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:41:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115509", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115509", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Jitsu console: missing await lets users alter other workspaces' sync cursors

In the Jitsu console, state handlers call findFirst without await, so the syncId ownership check never rejects a request. An authenticated user who knows another workspace's sync ID can read, overwrite or delete that workspace's stream cursors, causing data to be re-ingested or skipped.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jitsu console version; unknown whether the sources give an exact command.
- Look at sources/state.ts in the console code for handlers that call findFirst without await.

## Fix

- Upgrade the Jitsu console to `2.14.0-beta.41` or later.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115509
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115509

## From the sources

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_