---
id: CVE-2026-115509
title: >-
  Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via
  sources/state API
summary: >-
  Jitsu console before 2.14.0-beta.41 contains an incorrect authorization
  vulnerability in sources/state.ts handlers that call findFirst without await,
  so the syncId ownership check never fails. Authenticated users knowing another
  workspac…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: jitsucom
product: jitsu
affected:
  - jitsu < 2.14.0-beta.41
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:14:08.632Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115509'
references:
  - url: 'https://github.com/jitsucom/jitsu/issues/1242'
  - url: >-
      https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3
  - url: >-
      https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41
    label: jitsu jitsu-services2.14.0-beta.41 Release Notes
  - url: 'https://github.com/jitsucom/jitsu'
  - url: >-
      https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-api
    label: >-
      VulnCheck Advisory: Jitsu Console before 2.14.0-beta.41 Cross-Workspace
      Authorization Bypass via sources/state API
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.411Z'
---

## Overview

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

## Affected

- `jitsu < 2.14.0-beta.41`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.