CVE-2026-115509: Incorrect Authorization in jitsucom jitsu
Description
Jitsu versions before 2.14.0-beta.41 have an incorrect authorization vulnerability in the sources/state.ts handlers. The issue arises because the syncId ownership check is bypassed due to asynchronous handling errors, allowing authenticated users who know another workspace's sync ID to read, overwrite, or delete its stream cursors. This can lead to data re-ingestion or skipped data. The vulnerability has a low CVSS score of 2.3.
CVSS v4.0
Score 2.3low
Affected software
jitsucom
jitsu
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-115509 is an incorrect authorization vulnerability in jitsucom's jitsu product affecting versions prior to 2.14.0-beta.41. The flaw exists in the sources/state.ts handlers where calls to findFirst are made without awaiting the promise, causing the syncId ownership check to never fail properly. As a result, authenticated users with knowledge of another workspace's sync ID can manipulate stream cursors belonging to that workspace, potentially causing data re-ingestion or data loss due to skipped data.
Potential Impact
Authenticated users with knowledge of another workspace's sync ID can read, overwrite, or delete stream cursors of that workspace. This may result in data re-ingestion or skipped data, impacting data integrity and processing accuracy. The vulnerability does not allow privilege escalation beyond authenticated user access and has a low severity rating.
Mitigation Recommendations
Upgrade jitsu to version 2.14.0-beta.41 or later where this authorization issue is fixed. No other mitigation or workaround is indicated. Patch status is confirmed by the version boundary in the affectedVersions field.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T16:15:00.553Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada649d4d27ba8daa755e37
Added to database: 10/22/2026, 19:31:41 UTC
Last enriched: 10/22/2026, 21:00:28 UTC
Last updated: 10/22/2026, 21:00:28 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.