TI-2026-79491 CVE-2026-115509 · GHSA-vfq9-5jrr-qr65
Jitsu authorization bypass lets users alter other workspaces' cursors
Priority LOW 11
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails.