The flaw lies in the sources/state.ts handlers where a findFirst query is executed without awaiting the promise, causing the syncId ownership check to be omitted. As a result, an authenticated user who knows the sync ID of a stream belonging to another workspace can read, overwrite, or delete that workspace’s stream cursors. This permits data re‑ingestion or data loss within the victim workspace, undermining data integrity. The weakness stems from improper authorization handling (CWE‑863).

The Jitsu Console product from jitsucom is affected. All releases older than 2.14.0-beta.41 contain the problematic code. Any deployment of the console before this release is vulnerable to the bypass.

The CVSS score of 2.3 indicates a low severity classification, and the vulnerability is not listed in the CISA KEV catalog. Attackers must possess valid authenticated credentials and knowledge of a sync ID belonging to another workspace. No elevated privileges are required beyond account access, so the risk is confined to environments where users share infrastructure and can obtain sync IDs. With no EPSS data and limited exploitation evidence, the threat level is moderate, but the potential for data integrity compromise remains actionable.