CVE-2026-111605: Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, readfiledata.json, updatefiledata.json, delete.json, rename.json and newfilefolder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with SSH file permissions in any Jpom workspace can exploit it. The user does not need permissions in the target workspace if they can supply the ID of an SSH asset belonging to that workspace.
What access can an attacker gain on another workspace's SSH hosts?
The affected endpoints allow the attacker to download and read files, upload and update file contents, delete files, rename files, and create files or folders on SSH hosts assigned to other workspaces.
Which deployments are affected?
Jpom versions through 2.11.12 are affected. Exposure depends on having authenticated workspace users with SSH file permissions and SSH assets in more than one workspace.
How can administrators investigate possible abuse?
Review requests to the SSH file endpoints for SSH asset IDs that do not belong to the requesting user's workspace. Pay particular attention to download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json, and new_file_folder.json activity involving cross-workspace assets.