CVE-2026-120460
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows…
- Risk score
- 63/100
- CVSS
- 8.8 v3.1
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating p…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- On your watchlist: docker
References
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51
- https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28
- https://github.com/dromara/Jpom/issues/119
- https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers
Original description
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
Last activity 2 Nov 2026. Patch Forecast updates every hour.