Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck
CVE-2026-120460Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers
High 8.8
In plain English
A high-severity authorization bypass via user-controlled key in Jpom from dromara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/dromara/Jpom/issues/119 issue-tracking
- https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28 patch
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51 technical-description
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51 technical-description
- VulnCheck Advisory: Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers third-party-advisory