CVE-2026-120461

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/sshcommand/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to...

EUVD-2026-115221

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/sshcommand/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to...

CVE-2026-120461 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/sshcommand/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to...

CVE-2026-120461

The Jpom software (versions through 2.11.12 ) is susceptible to a cross-workspace authorization bypass via the POST /node/ssh_command/batch endpoint. The root cause is that the system resolves command templates and SSH nodes by ID without applying workspace filtering . This allows authenticated u...