Skip to content
OpenAdvisories

Product · dromara

Jpom

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-120461

    Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch

    Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can …

    dromara Jpom
  • High 8.8
    CVE-2026-120460

    Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

    Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control co…

    dromara Jpom
  • High 8.1
    CVE-2026-111605

    Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

    Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any…

    dromara Jpom