CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list
Authenticated users can bypass workspace isolation to access other workspaces' repositories and execute git commands using stored credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91993?
CVE-2026-91993 is a medium-severity missing authorization vulnerability in dromara Jpom, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.
Weakness: CWE-639
Which versions are affected by CVE-2026-91993?
How do I fix CVE-2026-91993?
No fix has been published for CVE-2026-91993 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-91993 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91993 exists.
Sources
Also known as GHSA-q5h7-5rfp-9ghc.