Executive brief
Jpom is a lightweight deployment and build automation platform that manages code repositories and CI/CD pipelines across different workspaces. A flaw in the /build/branch-list endpoint allows authenticated users to access and enumerate repositories belonging to other workspaces by submitting repository IDs from those workspaces, potentially exposing repository credentials and structure used for automated deployments.
Technical details
The vulnerability is an authorization bypass in the /build/branch-list endpoint that fails to validate workspace ownership when resolving repositoryId parameters. An authenticated user can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using stored credentials from those other workspaces. The attack requires authentication but does not require additional user interaction. An attacker can discover repositories across workspaces and potentially extract sensitive information from repository configurations or credentials. The flaw affects Jpom through version 2.11.12; patches for later versions should be available.
Affected products
- dromara Jpom through 2.11.12
Timeline
- 2026-09-15: disclosed