CVE-2026-120460Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

Beschreibung

Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/dromara/Jpom/issues/119 issue-tracking
• https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28 patch
• https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker… technical-description
• https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker… technical-description
• VulnCheck Advisory: Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers third-party-advisory