5 matches found
CVE-2026-91993
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...
CVE-2026-91993
Jpom through 2.11.12 is affected by a workspace isolation bypass on the /build/branch-list endpoint. The root cause is a failure to validate workspace ownership when resolving a repositoryId , allowing any authenticated user to reference repositories belonging to other workspaces. Attackers can e...
EUVD-2026-78433
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...
PT-2026-91933
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...
CVE-2026-91993: Authorization Bypass Through User-Controlled Key
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...