5.3
Moyenne
CVE-2026-91993 Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list…
Description
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jpom 2.11 | premières → 2.11.12 | Pas de correctif indiqué |
Autres CVE de Jpom
Les 5 CVE de Jpom →
CVE-2026-120461
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves…
8.7
Élevée
CVE-2026-120460
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to…
8.7
Élevée
CVE-2026-120201
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
9.3
Critique
CVE-2026-111605
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated…
8.6
Élevée