CVE-2026-115509

Jitsu Console versions prior to 2.14.0-beta.41 are vulnerable to a cross-workspace authorization bypass within the sources/state.ts handlers. The root cause is that these handlers call findFirst without the await keyword, which prevents the syncId ownership check from failing as intended. Consequ...