{"cve":"CVE-2026-111605","nvd":{"published":"2026-10-16T18:17:39.490","modified":"2026-10-19T13:16:55.677","status":"Deferred","description":"Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-639"],"references":["https://github.com/dromara/Jpom","https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/SshFileController.java#L44-L65","https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor","https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-sshfilecontroller","https://hackmd.io/@hieuPenguinnn/jpom-ssh-file-cross-workspace-idor"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-111605","score":0.00318,"percentile":0.2447,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}