Cross-Workspace Authorization Bypass in Jpom by Dromara

CVE-2026-120461

What is CVE-2026-120461?

Jpom up to version 2.11.12 is susceptible to a cross-workspace authorization bypass. The flaw exists in the handling of SSH command execution, allowing authenticated users with the right permissions to leverage command templates and node IDs from other workspaces. This means that an attacker could use their valid credentials to execute commands on SSH hosts within different workspaces, violating intended access controls. This vulnerability can pose serious security risks, including unauthorized data access and command execution across segregated environments. Organizations using Jpom should take immediate steps to mitigate this issue by applying the latest patches.

References