Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

Advisories

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

Severity: high
Date: 10/16/2026
Affecting: Jpom <= 2.11.12
CVE: CVE-2026-111605
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor
https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/SshFileController.java#L44-L65
https://github.com/dromara/Jpom
Credit: hieuPenguinnn
Description: Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo