---
id: CVE-2026-115509
title: >-
  Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via
  sources/state API
summary: >-
  Jitsu console before 2.14.0-beta.41 contains an incorrect authorization
  vulnerability in sources/state.ts handlers that call findFirst without await,
  so the syncId ownership check never fails. Authenticated users knowing another
  workspac…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: jitsucom
product: jitsu
affected:
  - jitsu < 2.14.0-beta.41
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T12:24:26.897616Z'
published: '2026-10-22'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T12:24:50.785Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115509'
references:
  - url: 'https://github.com/jitsucom/jitsu/issues/1242'
  - url: >-
      https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3
  - url: >-
      https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41
    label: jitsu jitsu-services2.14.0-beta.41 Release Notes
  - url: 'https://github.com/jitsucom/jitsu'
  - url: >-
      https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-api
    label: >-
      VulnCheck Advisory: Jitsu Console before 2.14.0-beta.41 Cross-Workspace
      Authorization Bypass via sources/state API
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.06247
ingestedAt: '2026-10-22T22:00:50.411Z'
---

## Overview

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

## Affected

- `jitsu < 2.14.0-beta.41`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.