CVE-2026-111605 in Jpom
Summary
by MITRE • 10/16/2026
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within Jpom versions up to 2.11.12 represents a critical authorization bypass flaw located in the SshFileController component of the application architecture. This security defect stems from an insufficient validation mechanism when handling requests related to Secure Shell file operations. Specifically, the system fails to enforce strict ownership checks on SSH host identifiers provided by authenticated users. In a properly secured environment, access control lists or role-based permissions should verify that the requesting user has explicit rights not only within their assigned workspace but also over the specific remote infrastructure resources they are attempting to interact with. However, in this vulnerable implementation, the application relies primarily on the presence of valid authentication and general SSH file permissions within any single workspace to grant access, ignoring whether those permissions extend to the target SSH host associated with a different workspace.
This architectural oversight allows an attacker who possesses legitimate credentials for one workspace to manipulate identifiers pointing to SSH assets belonging to other distinct workspaces. By supplying foreign or cross-workspace SSH asset IDs in API requests, the authenticated user can bypass logical access controls designed to isolate resources between separate organizational units or project spaces within Jpom. The vulnerability affects multiple endpoints including download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json, and new_file_folder.json. Each of these endpoints performs file system operations on remote servers via SSH protocols without verifying that the user’s permissions encompass the specific target host. Consequently, an attacker can execute a wide range of destructive or intrusive actions against infrastructure they are not authorized to access.
The operational impact of this vulnerability is severe due to the breadth of capabilities exposed through these endpoints. An adversary with minimal initial privileges in one workspace can achieve significant lateral movement and data compromise across other workspaces hosted on different servers. They may read sensitive configuration files, source code, or proprietary data from unauthorized SSH hosts by invoking the read_file_data.json endpoint. Furthermore, they possess the ability to modify existing files through update_file_data.json or rename.json, potentially altering system configurations or injecting malicious content into deployment scripts. The delete.json and new_file_folder.json endpoints allow for denial of service conditions or further persistence mechanisms by removing critical assets or creating directories for subsequent exploitation. This effectively breaks the isolation boundaries intended between workspaces, leading to a complete compromise of confidentiality, integrity, and availability across multiple environments managed under a single Jpom instance.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in object-level permission checks where user input is not adequately validated against access policies before performing actions on resources. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation requires legitimate credentials but abuses them to access unauthorized resources, and potentially T1530 Data from Cloud Storage if the SSH hosts contain sensitive data stores. The flaw exemplifies a common pitfall in multi-tenant or workspace-based applications where identity verification is decoupled from resource authorization checks during API processing.
Mitigation strategies must prioritize immediate patching to version 2.11.13 or later, which addresses this logic error by implementing rigorous ownership validation for all SSH file operations. In the interim, administrators should restrict network access to Jpom management interfaces and enforce strict firewall rules limiting exposure of administrative endpoints. Additionally, adopting a principle of least privilege ensures that users are granted only the minimum permissions necessary for their specific workspace tasks, reducing the blast radius if an account is compromised. Security teams should also implement comprehensive logging and monitoring on SSH file operation endpoints to detect anomalous patterns such as rapid cross-workspace asset ID access attempts, enabling faster incident response and forensic analysis in the event of exploitation.