CVE-2026-111605
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
Risk Assessment
An attacker can read, modify, and delete files on other workspaces' SSH hosts, leading to data integrity and confidentiality breaches and potential system destruction. This may also enable further escalation within the environment.
Recommendation
Upgrade Jpom to a version later than 2.11.12 if available, or restrict access to SshFileController. Implement ownership verification of SSH assets before performing file operations.
Other vulnerabilities in Jpom
See all- CVE-2026-120461High
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs.
- CVE-2026-120460High
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks.
- CVE-2026-120201Critical
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
- CVE-2026-91993Medium
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint. An authenticated user can access repositories from other workspaces, including enumerating repository existence, determining repository type, and executing git ls-remote commands using other workspaces' stored credentials.
Original NVD description (English source)
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS