Authorization Vulnerability in Jitsu Console by JitsuCom
CVE-2026-115509

2.3LOW

Key Information:

Vendor

Jitsucom

Status
Jitsu
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115509?

The Jitsu Console prior to version 2.14.0-beta.41 contains an vulnerability that allows authenticated users to bypass authorization checks. Specifically, due to an issue in the sources/state.ts handlers, the syncId ownership check does not execute properly. As a result, users can exploit the system to access, modify, or delete stream cursors of other workspaces if they know the sync ID. This can lead to data re-ingestion or crucial data being skipped, posing significant risks to data integrity and privacy.

Affected Version(s)

jitsu 0 < 2.14.0-beta.41

References

https://github.com/jitsucom/jitsu/issues/1242
issue-tracking
https://github.com/jitsucom/jitsu/commit/9359d575ba50cd38...
patch
https://github.com/jitsucom/jitsu/releases/tag/jitsu-serv...
release-notes

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.