Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for jitsu by jitsucom

    CVE-2026-115509 (GCVE-0-2026-115509)

    Vulnerability from nvd – Published: 2026-10-22 19:14 – Updated: 2026-10-22 19:14
    VLAI
    Title
    Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
    Summary
    Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
    Severity
    2.3 (Low)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
    4.2 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6762 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    jitsucom jitsu Affected: 0 , < 2.14.0-beta.41 (semver)
    		Create a notification for this product.
    Date Public
    2026-02-20 00:00
    Credits
    lighthousekeeper1212 leediay153 from Viettel Post
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "jitsu",
          "repo": "https://github.com/jitsucom/jitsu",
          "vendor": "jitsucom",
          "versions": [
            {
              "lessThan": "2.14.0-beta.41",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lighthousekeeper1212"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-02-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace\u0027s sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T19:14:08.632Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/jitsucom/jitsu/issues/1242"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3"
        },
        {
          "name": "jitsu jitsu-services2.14.0-beta.41 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/jitsucom/jitsu"
        },
        {
          "name": "VulnCheck Advisory: Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-api"
        }
      ],
      "title": "Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115509",
    "datePublished": "2026-10-22T19:14:08.632Z",
    "dateReserved": "2026-10-22T16:15:00.553Z",
    "dateUpdated": "2026-10-22T19:14:08.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-115509 (GCVE-0-2026-115509)

    Vulnerability from cvelistv5 – Published: 2026-10-22 19:14 – Updated: 2026-10-22 19:14
    VLAI
    Title
    Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
    Summary
    Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
    Severity
    2.3 (Low)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
    4.2 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6762 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    jitsucom jitsu Affected: 0 , < 2.14.0-beta.41 (semver)
    		Create a notification for this product.
    Date Public
    2026-02-20 00:00
    Credits
    lighthousekeeper1212 leediay153 from Viettel Post
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "jitsu",
          "repo": "https://github.com/jitsucom/jitsu",
          "vendor": "jitsucom",
          "versions": [
            {
              "lessThan": "2.14.0-beta.41",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lighthousekeeper1212"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-02-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace\u0027s sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T19:14:08.632Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/jitsucom/jitsu/issues/1242"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/jitsucom/jitsu/commit/9359d575ba50cd383e7762f9034154dea9346eb3"
        },
        {
          "name": "jitsu jitsu-services2.14.0-beta.41 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/jitsucom/jitsu/releases/tag/jitsu-services2.14.0-beta.41"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/jitsucom/jitsu"
        },
        {
          "name": "VulnCheck Advisory: Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/jitsu-console-before-2.14.0-beta.41-cross-workspace-authorization-bypass-via-sources-state-api"
        }
      ],
      "title": "Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115509",
    "datePublished": "2026-10-22T19:14:08.632Z",
    "dateReserved": "2026-10-22T16:15:00.553Z",
    "dateUpdated": "2026-10-22T19:14:08.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}