MEDIUMCVSS v3.1 4.2Vulnerability
CVE-2026-115509
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Cvss score
- 4.2
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-22T22:16:40+00:00
- Score
- 4.2
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-115509
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-10-22T22:12:23+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Published at
- 2026-10-22T20:17:07.060
- Last modified
- 2026-10-22T20:17:07.060
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph