Threat database

Jitsu versions before 2.14.0-beta.41 have an incorrect authorization vulnerability in the sources/state.ts handlers. The issue arises because the syncId ownership check is bypassed due to asynchronous handling errors, allowing authenticated users who know another workspace's sync ID to read, overwrite, or delete its stream cursors. This can lead to data re-ingestion or skipped data. The vulnerability has a low CVSS score of 2.3.