Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91993Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in Jpom from dromara. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 72.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.

Affected products (as reported)

Vendor	Product	Versions
dromara	Jpom	0 – through 2.11.12

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Issue #115 issue-tracking, exploit
BuildInfoController.branchList at v2.11.12 technical-description
https://github.com/dromara/Jpom product
VulnCheck Advisory: Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list third-party-advisory