Approved changes feed: RSS · Atom
cpe:2.3:a:jitsucom:jitsu:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Jitsucom (911d4098-9519-5836-b7e8-2a4501f07f4d) |
|---|---|
| Product | Jitsu (4be1ba64-ff24-514f-b679-5967c5677d48) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115509 |
vulnerable | 2026-11-03 10:15:37.322386 |
Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
MEDIUM (4.2)
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
Published: 2026-10-22T19:14:08.632Z
Updated: 2026-10-29T12:24:50.785Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.