CVE-2026-91993: Jpom Authentication Bypass Vulnerability

CVE-2026-91993 Overview

CVE-2026-91993 is a workspace isolation bypass affecting Jpom through version 2.11.12, an open-source build and deployment operations platform. The /build/branch-list endpoint fails to validate workspace ownership when resolving the repositoryId parameter. Authenticated users can submit repository identifiers belonging to other workspaces to enumerate repositories, determine repository types, and trigger git ls-remote commands using credentials stored in the target workspace. The flaw is categorized as an Insecure Direct Object Reference [CWE-639] and breaks the multi-tenant separation that workspaces are intended to provide.

Critical Impact

Authenticated tenants can access repositories in other workspaces and reuse their stored Git credentials to reach external repositories.

Affected Products

• Jpom versions through 2.11.12
• Component: BuildInfoController.java in the server module
• Endpoint: /build/branch-list

Discovery Timeline

• 2026-09-15 - CVE-2026-91993 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91993

Vulnerability Analysis

Jpom organizes tenants using workspaces, where each workspace owns its own build definitions, repositories, and stored credentials. The /build/branch-list endpoint accepts a repositoryId parameter and resolves the corresponding repository record without checking that the caller belongs to the workspace that owns it. As a result, any authenticated user can supply a repositoryId from another workspace and receive server-side behavior scoped to that foreign repository. The server then executes git ls-remote against the referenced repository using the credentials attached to it, effectively allowing one tenant to weaponize another tenant's stored Git credentials for reconnaissance.

Root Cause

The root cause is missing authorization on an object reference. The controller trusts the client-supplied repositoryId and loads the repository directly from the data store without filtering by the authenticated user's workspace. This is a classic Insecure Direct Object Reference pattern [CWE-639] where the application enforces authentication but not per-object authorization. The vulnerable code path is documented in BuildInfoController.java between lines 436 and 454 in the Jpom v2.11.12 source.

Attack Vector

Exploitation requires only a low-privileged authenticated account on any workspace. An attacker enumerates or guesses repositoryId values assigned to other workspaces and submits requests to /build/branch-list. The server response reveals whether a repository exists and its type, and the backend performs a git ls-remote using the foreign workspace's stored credentials. Attackers can use the technique to map tenant assets, validate that credentials remain valid, and potentially reach internal Git hosts referenced by other tenants. See the Vulncheck advisory and GitHub Issue #115 for additional context.

Detection Methods for CVE-2026-91993

Indicators of Compromise

• Requests to /build/branch-list where the repositoryId parameter does not correspond to any repository owned by the authenticated user's workspace.
• Unexpected git ls-remote process executions spawned by the Jpom server against repositories that the requesting user should not be able to see.
• Repeated /build/branch-list requests from a single account iterating through sequential or randomized repositoryId values.

Detection Strategies

• Enable verbose access logging on the Jpom server and correlate each /build/branch-list request with the workspace ownership of the supplied repositoryId.
• Baseline normal per-user repository access and alert when a user references repository identifiers outside their assigned workspaces.
• Monitor outbound Git traffic from the Jpom host for connections to repository hosts not previously associated with the initiating user.

Monitoring Recommendations

• Ship Jpom application and process logs to a centralized analytics platform and retain them long enough to reconstruct enumeration campaigns.
• Alert on high-volume enumeration patterns against build controller endpoints, focusing on repositoryId, buildId, and similar object references.
• Review stored Git credentials for signs of reuse from unexpected source IPs after any suspected exploitation.

How to Mitigate CVE-2026-91993

Immediate Actions Required

• Restrict network access to the Jpom management interface so that only trusted administrators and CI operators can authenticate.
• Audit workspace membership and remove accounts that no longer require access, reducing the pool of users who can invoke /build/branch-list.
• Rotate stored Git credentials in any workspace that may have been referenced by unauthorized users, particularly credentials for internal Git servers.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. The vulnerability affects Jpom through 2.11.12. Track the Jpom GitHub repository and the Vulncheck advisory for updated release information, and upgrade as soon as a patched build is published.

Workarounds

• Place Jpom behind a reverse proxy that enforces path-based access controls and rate limits on /build/branch-list.
• Segment multi-tenant deployments by running separate Jpom instances per trust boundary instead of relying on workspace isolation within a single instance.
• Where feasible, replace shared long-lived Git credentials with short-lived tokens scoped to a single repository to limit the value of any credential reuse.

# Example reverse-proxy restriction (nginx) limiting the vulnerable endpoint
# to an internal management network until an upstream patch is applied.
location = /build/branch-list {
    allow 10.0.0.0/24;
    deny  all;
    proxy_pass http://jpom_backend;
}