Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.14.0-beta.41
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Jitsu Console, a web-based management interface for the Jitsu data pipeline platform, is affected. An authenticated user who knows the sync ID of another workspace can read, overwrite, or delete that workspace's stream cursors, which may cause data to be ingested again or skipped.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- jitsucom jitsu
fixed in 2.14.0-beta.41