8.7
Élevée
CVE-2026-120461 Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves…
Description
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jpom 2.11 | premières → 2.11.12 | Pas de correctif indiqué |
Autres CVE de Jpom
Les 5 CVE de Jpom →
CVE-2026-120460
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to…
8.7
Élevée
CVE-2026-120201
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
9.3
Critique
CVE-2026-111605
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated…
8.6
Élevée
CVE-2026-91993
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list…
5.3
Moyenne