CVE-2026-115509 in Jitsu
Summary
by MITRE • 10/22/2026
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The Jitsu console prior to version 2.14.0-beta.41 contains a critical authorization flaw rooted in asynchronous programming errors within the sources/state.ts module. This vulnerability arises from handlers that invoke database queries using methods such as findFirst without properly awaiting their completion. In JavaScript and TypeScript environments, failing to await an async function results in the code proceeding immediately with unresolved promises rather than waiting for the actual data retrieval or validation logic to finish. Consequently, the synchronization ID ownership check, which is designed to verify whether a user has permission to access specific workspace resources, effectively becomes bypassed because the authorization logic does not receive the necessary context before making decisions about access control.
This technical deficiency allows authenticated users who are aware of another workspace's synchronization identifier to perform unauthorized operations on that target workspace's data streams. Specifically, an attacker can read sensitive stream cursor information, overwrite existing cursors with malicious values, or delete them entirely. The core issue is a failure in enforcing proper authorization checks due to the race condition created by unawaited asynchronous calls, which aligns with CWE-284 Improper Access Control and CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization Race Condition.
The operational impact of this vulnerability is significant for data integrity and pipeline reliability. By manipulating stream cursors, an attacker can force the system to re-ingest historical data unnecessarily, leading to increased storage costs and potential duplication issues in downstream analytics platforms. Conversely, deleting or corrupting these cursors can cause the ingestion process to skip new incoming events entirely, resulting in critical gaps in data availability and loss of real-time insights for business intelligence operations. This disruption affects the reliability of the entire data pipeline managed by Jitsu.
To mitigate this vulnerability, organizations must upgrade immediately to version 2.14.0-beta.41 or any later stable release where these asynchronous handling errors have been corrected. Developers should ensure that all database queries involving security-sensitive checks are properly awaited before proceeding with authorization decisions. Additionally, implementing strict input validation and ensuring that ownership verification logic is executed synchronously relative to the request lifecycle will prevent similar race conditions in future development cycles. Monitoring logs for unusual patterns of cursor access across different workspaces can also help detect potential exploitation attempts while patches are being applied.