{"id":"CVE-2026-91993","title":"Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces","summary":"Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identif…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-639"],"vendor":"dromara","product":"Jpom","affected":["Jpom <= 2.11.12"],"published":"2026-09-15","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:44.853","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91993","references":[{"url":"https://github.com/dromara/Jpom","label":"disclosure@vulncheck.com"},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/build/BuildInfoController.java#L436-L454","label":"disclosure@vulncheck.com"},{"url":"https://github.com/dromara/Jpom/issues/115","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-workspace-isolation-bypass-via-build-branch-list","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00251,"epssPercentile":0.16797,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T18:38:10.941055Z"},"ingestedAt":"2026-09-15T12:36:50.172Z","slug":"CVE-2026-91993","body":"## Overview\n\nJpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":206545,"id":"CVE-2026-91993","ts":1789676923180,"field":"exploit_available","old":"false","new":"true"}]}