Cross-Workspace Authorization Bypass Vulnerability in Jpom by dromara

CVE-2026-120460

What is CVE-2026-120460?

The vulnerability in Jpom versions up to 2.11.12 allows authenticated users to bypass workspace authorization controls. By supplying foreign Docker asset IDs, users with Docker permissions can manage Docker hosts associated with other workspaces. This security flaw permits unauthorized control over containers, images, volumes, and networks, leading to risk exposure through the creation of privileged containers with host bind mounts. Users should take immediate action to review their Docker permissions and upgrade to the latest version to mitigate the risk.

References