Authenticated users who possess permission to execute SSH commands in any single workspace may exploit a missing workspace filter to target resources in another workspace. By submitting a POST request to /node/ssh_command/batch with IDs that belong to a foreign workspace, the system resolves command templates and SSH nodes without validating the owner workspace, allowing the attacker to run arbitrary commands on unsuspected hosts. This flaw directly enables unauthorized users to gain code‑execution privileges on machines maintained in other workspaces, potentially compromising confidentiality, integrity, and availability of those systems.

The vulnerability exists in Jpom versions up to and including 2.11.12, which is maintained by the dromara vendor. All installations that use the /node/ssh_command/batch endpoint and assign SSH command execution rights to users are affected. No specific sub‑versions within 2.11.12 are listed as exempt, so the entire 2.11.12 release is vulnerable.

The flaw is rated with a CVSS score of 8.7, indicating high severity. EPSS data is not available, suggesting no publicly measured exploitation probability, and the issue is not cataloged in the CISA KEV catalog. The lack of workspace filtering allows direct exploitation once the attacker has an authenticated session with command‑execution rights in any workspace, so the attack vector is local authentication. Given the high CVSS and lack of mitigation, this represents a significant risk if internal users or compromised accounts exist.