CVE-2026-91993: Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jpomto a version that resolves this vulnerability.Fixed in 2.11.12 - Configuration
Patch Jpom to enforce workspace ownership validation when resolving repositoryId on the /build/branch-list endpoint (the flaw affects versions through 2.11.12).
Jpom /build/branch-list endpoint workspace ownership validation for repositoryId = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Jpom user with privileges sufficient to call the /build/branch-list endpoint can exploit it. The attacker needs a repositoryId belonging to another workspace; the issue can also be used to enumerate whether such repositories exist.
What information or actions can an attacker obtain?
An attacker can determine the existence and type of repositories in other workspaces. They can also cause git ls-remote commands to run using credentials stored by the affected workspace, potentially exposing remote repository branch or reference information.
Are deployments affected by default?
The provided information confirms the issue affects Jpom through 2.11.12, but does not state whether the endpoint is enabled or reachable in a default deployment. Exploitation requires an authenticated account and access to the affected endpoint.
How can I check for exposure?
Review access to /build/branch-list and identify authenticated users who can submit repositoryId values. Test whether a user in one workspace can supply a repositoryId from another workspace and receive repository existence, type, or remote-reference results.