Jitsu
Monthly
Jitsu Console before 2.14.0-beta.41 allows an authenticated user who knows another workspace's sync ID to read, overwrite, or delete that workspace's stream cursors, causing data re-ingestion or skipped data. The flaw is a missing await on a Prisma findFirst ownership lookup in the sources/state API, so the authorization comparison evaluates a truthy Promise and never rejects the cross-workspace request. It is low severity (CVSS 4.0 score 2.3) and scoped to cursor state, and no public exploit was identified at time of analysis.
Jitsu Console before 2.14.0-beta.41 allows an authenticated user who knows another workspace's sync ID to read, overwrite, or delete that workspace's stream cursors, causing data re-ingestion or skipped data. The flaw is a missing await on a Prisma findFirst ownership lookup in the sources/state API, so the authorization comparison evaluates a truthy Promise and never rejects the cross-workspace request. It is low severity (CVSS 4.0 score 2.3) and scoped to cursor state, and no public exploit was identified at time of analysis.