CVE-2026-111605highCWE-639

CVE-2026-111605: fallo de gravedad alta en dromara Jpom

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Jpom

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 0.3%
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
dromara · Jpom
CVEs relacionadas — dromara Jpom

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-120201CRITICALJpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN HeaderEPSS 0.6%CVE-2026-120461HIGHJpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batchEPSS 0.4%CVE-2026-120460HIGHJpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker ControllersEPSS 0.4%CVE-2026-91993MEDIUMJpom through 2.11.12 Workspace Isolation Bypass via /build/branch-listEPSS 0.3%