Jpom up to version 2.11.12 contains an authorization bypass that allows an authenticated user with Docker privileges in one workspace to manipulate Docker resources belonging to any other workspace. By supplying a foreign Docker asset identifier, the attacker can control containers, images, volumes, and networks, including creating privileged containers that mount the host filesystem. This flaw permits the attacker to escape the intended workspace boundaries.

Vendors affected include dromara's Jpom application. The vulnerability exists in all releases through version 2.11.12, meaning version 2.11.12 and earlier are impacted. Users deploying Jpom for managing Docker hosts should verify the installed version and apply a newer release once available.

The CVSS score of 8.7 indicates a high severity. Because the attack requires an authenticated session with Docker permissions, exploitation is likely limited to users already authorized within the application. The EPSS score is not available, but given the nature of the flaw, the risk to systems running Jpom remains significant, especially in environments where multiple workspaces share a host. The vulnerability is currently not listed in the CISA KEV catalog.