CVE-2026-120461
highJpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID withou…
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpo... disclosure@vulncheck.com
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpo... disclosure@vulncheck.com
- https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28 disclosure@vulncheck.com
- https://github.com/dromara/Jpom/issues/120 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-by... disclosure@vulncheck.com