CVE-2026-115509

Name of the Vulnerable Software and Affected Versions Jitsu console versions prior to 2.14.0-beta.41

Description An incorrect authorization issue exists in the sources/state.ts handlers. The problem occurs because the findFirst() function is called without the await keyword, which prevents the syncId ownership check from executing properly. Consequently, authenticated users who possess the syncId of another workspace can read, overwrite, or delete its stream cursors, potentially leading to skipped data or the re-ingestion of data.

Recommendations Update to version 2.14.0-beta.41 or later.