CVE-2026-115509

MEDIUM4.2

Published 2026-10-22 · Source disclosure@vulncheck.com

Description

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-863

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-115508
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
2026-10-22 · score 6.5
CVE-2026-115503
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
2026-10-22 · score 5.5
CVE-2026-115398
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
2026-10-22 · score 5.5
CVE-2026-95720
No description provided
2026-10-22 · score 4.4
CVE-2026-95719
No description provided
2026-10-22 · score 4.9