CVE-2026-115509 jitsucom CVE debrief

Who should care

Defenders responsible for Jitsu Console deployments should assess exposure and prioritize verification of workspace configurations and authorization checks. They should also ensure proper authorization checks are in place and upgrade to version 2.14.0-beta.41 or later. Additionally, defenders should monitor for suspicious activity on stream cursors and review compensating controls for exposed systems.

Why it matters

CVE-2026-115509 is a low-severity vulnerability that allows authenticated users to bypass cross-workspace authorization, potentially leading to data re-ingestion or skipped data. Defenders should prioritize verifying workspace configurations and upgrading to version 2.14.0-beta.41 or later.

• Potential data re-ingestion or skipped data due to unauthorized stream cursor modifications
• Increased risk of data tampering or unauthorized access

Technical summary

The vulnerability is caused by an incorrect authorization check in the sources/state.ts handlers, which call findFirst without await, allowing the syncId ownership check to never fail. This enables authenticated users to read, overwrite, or delete stream cursors in another workspace, potentially causing data re-ingestion or skipped data. The vulnerability affects Jitsu Console before version 2.14.0-beta.41 and has a CVSS score of 2.3. Defenders should prioritize verifying workspace configurations and upgrading to version 2.14.0-beta.41 or later.

Defensive priority

Defenders should prioritize verifying workspace configurations, ensuring proper authorization checks are in place, and upgrading to version 2.14.0-beta.41 or later.

Recommended defensive actions

• Verify workspace configurations to ensure proper authorization checks are in place
• Upgrade to version 2.14.0-beta.41 or later
• Monitor for suspicious activity on stream cursors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to issue tracking, patch, and release notes. The vulnerability allows authenticated users to bypass cross-workspace authorization, potentially leading to data re-ingestion or skipped data. Defenders should verify workspace configurations, ensure proper authorization checks are in place, and upgrade to version 2.14.0-beta.41 or later. Evidence is limited to CVE Program and source item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.