High severity · published Oct 16, 2026
CVE-2026-111605
Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Jpom · dromara
through 2.11.12 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111605
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111605
github.com
https://github.com/dromara/Jpom
github.com
https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/SshFileController.java#L44-L65
hackmd.io
https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor
www.vulncheck.com
https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-sshfilecontroller
More from Jpom
4.3
CVE-2026-91993
Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list