High severity8.8NVD Advisory· Published Nov 2, 2026· Updated Nov 2, 2026
CVE-2026-120460
CVE-2026-120460
Description
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.javanvd
- github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.javanvd
- github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28nvd
- github.com/dromara/Jpom/issues/119nvd
- www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllersnvd
News mentions
0No linked articles in our index yet.