Authorization Bypass Vulnerability in Jpom SshFileController

Jpom versions up to and including 2.11.12 contain a critical authorization bypass vulnerability located in the SshFileController component, identified as CVE-2026-111605. This vulnerability allows an authenticated user with existing file management permissions in their own workspace to gain unauthorized access to SSH hosts associated with other workspaces. By manipulating the SSH asset identifier within API requests, a malicious user can bypass workspace-level access controls.

This flaw grants the attacker unauthorized access to various file management endpoints, including downloading, uploading, reading, modifying, renaming, and deleting files on the compromised SSH host. The vulnerability represents a significant risk to environment isolation within the Jpom management platform, potentially leading to unauthorized data exfiltration or system modification. Defenders should prioritize patching to the version addressing this authorization flaw.

Impact

The vulnerability allows for horizontal privilege escalation within Jpom, enabling attackers to execute sensitive file operations on SSH hosts outside their assigned workspace scope. If exploited, an attacker can read, modify, or delete files on any SSH host managed by the Jpom instance, facilitating data theft or persistence via configuration changes. The impact is significant for multi-tenant or multi-workspace environments.

Recommendation

1. Upgrade Jpom to a version released after 2.11.12 that incorporates a patch for CVE-2026-111605.
2. Implement monitoring on Jpom web API endpoints to alert on unusual usage patterns where a single authenticated session interacts with multiple distinct SSH asset IDs.
3. Review access logs for the Jpom SshFileController endpoints mentioned (download, upload, read_file_data.json, etc.) to identify anomalies originating from accounts that should only have workspace-restricted access.