---
id: CVE-2026-120461
title: >-
  Jpom through 2.11.12 Cross-Workspace Authorization Bypass via
  /node/ssh_command/batch
summary: >-
  Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST
  /node/ssh_command/batch that resolves command templates and SSH nodes by ID
  without workspace filtering. Authenticated users with SSH command execute
  permission…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
vendor: dromara
product: Jpom
affected:
  - Jpom <= 2.11.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T15:47:16.110618Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:47:46.214Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120461'
references:
  - url: 'https://github.com/dromara/Jpom/issues/120'
  - url: >-
      https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28
  - url: >-
      https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184
  - url: >-
      https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169
  - url: >-
      https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch
    label: >-
      VulnCheck Advisory: Jpom through 2.11.12 Cross-Workspace Authorization
      Bypass via /node/ssh_command/batch
tags:
  - cve.org
epss: 0.00373
epssPercentile: 0.31368
ingestedAt: '2026-11-05T19:30:42.695Z'
---

## Overview

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.

## Affected

- `Jpom <= 2.11.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.