An authorization bypass in Jpom's SshFileController allows an authenticated user with SSH file privileges in any workspace to access, read, modify, or delete files on SSH hosts belonging to other workspaces by supplying foreign SSH asset IDs. This flaw permits unauthorized cross‑workspace data manipulation and potentially facilitates higher‑level attacks such as scripting on those hosts.

The flaw affects Jpom version 2.11.12 and earlier, including all releases up to that point, from the dromara organization. Users running these versions in a production environment are potentially exposed.

The CVSS base score of 8.6 highlights a high severity with high impact and exploitability. EPSS data is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to a workspace and possess SSH file permissions, suggesting that compromised or privileged user accounts are the primary exploitation vector.