CVE-2026-115509: Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Jitsu Console versions before 2.14.0-beta.41 are affected. The issue is in the sources/state API handlers.
What does an attacker need to exploit this issue?
An attacker needs an authenticated user account and knowledge of a sync ID belonging to another workspace. Exploitation also requires the attacker to reach the affected sources/state API.
What could an attacker do with a target sync ID?
They can read, overwrite, or delete stream cursors for the other workspace. This can cause data to be re-ingested or data to be skipped.
How can teams determine whether they may be affected?
Verify whether the deployed Jitsu Console version is earlier than 2.14.0-beta.41 and whether users can access the sources/state API. Review access and activity involving sync IDs from other workspaces for unexpected cursor reads, updates, or deletions.