---
id: CVE-2026-111605
title: >-
  Jpom through 2.11.12 Cross-Workspace Authorization Bypass via
  SshFileController
summary: >-
  Jpom through 2.11.12 contains an authorization bypass vulnerability in
  SshFileController that allows authenticated workspace users to access SSH
  hosts belonging to other workspaces by supplying foreign SSH asset ids.
  Attackers with SSH f…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: dromara
product: Jpom
affected:
  - Jpom <= 2.11.12
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:38:46.940Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111605'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor'
  - url: >-
      https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/SshFileController.java#L44-L65
  - url: 'https://github.com/dromara/Jpom'
  - url: >-
      https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-sshfilecontroller
    label: >-
      VulnCheck Advisory: Jpom through 2.11.12 Cross-Workspace Authorization
      Bypass via SshFileController
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.699Z'
---

## Overview

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.

## Affected

- `Jpom <= 2.11.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.