CVE-2026-91993Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Beschreibung

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Issue #115 issue-trackingexploitExploitIssue Tracking
• BuildInfoController.branchList at v2.11.12 technical-descriptionProduct
• https://github.com/dromara/Jpom productProduct
• VulnCheck Advisory: Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list third-party-advisoryThird Party Advisory