Authorization Bypass in Jpom's SSH File Management by Dromara

CVE-2026-111605

What is CVE-2026-111605?

Jpom versions up to 2.11.12 contain an authorization bypass vulnerability in the SshFileController component, enabling authenticated users from one workspace to access SSH hosts associated with other workspaces. By using foreign SSH asset IDs, an attacker with file permissions in any workspace can exploit various endpoints, including download, upload, and file modification functions, potentially leading to unauthorized data access or manipulation across different workspaces.

References