CVE-2026-91993

MediumCVSS 4.3

Published: 15/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint. An authenticated user can access repositories from other workspaces, including enumerating repository existence, determining repository type, and executing git ls-remote commands using other workspaces' stored credentials.

Risk Assessment

An attacker with a valid account can disclose the existence and type of other teams' repositories and leverage their stored credentials for git operations, breaking workspace isolation.

Recommendation

Upgrade Jpom beyond 2.11.12 where workspace ownership validation is fixed, and review logs for unusual /build/branch-list requests.

Other vulnerabilities in Jpom

CVE-2026-111605High
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.

Original NVD description (English source)

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS