Jpom cross-workspace authorization bypass via Docker controllers

Anyone with Docker access can control other teams' container machines in this program.

Summary

Authenticated users of the Jpom server management program can control other workspaces' Docker hosts by supplying their asset IDs, including containers, images, volumes and networks. Versions through 2.11.12 are affected.

Affected when

Login account with Docker permission
Jpom through 2.11.12

What to do

Check that Jpom runs a version newer than 2.11.12, and read the vendor's advisory. No fixed version is named in the sources.

Products and platforms

dromara Jpom

CVE IDs

CVE-2026-120460 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC