CVE-2026-91993 dromara CVE debrief

Who should care

Defenders responsible for Jpom instances, security teams, and administrators of systems using Jpom should assess exposure and prioritize remediation. They should verify the affected versions, check for patches or updates provided by the vendor, and ensure proper workspace isolation. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and

Why it matters

CVE-2026-91993 allows authenticated users to bypass workspace isolation in Jpom, potentially leading to unauthorized repository access and enumeration. Defenders should verify and remediate this vulnerability, focusing on restricting access to repository identifiers and ensuring proper workspace isolation.

• Repository enumeration and existence checks can be performed by authenticated users
• Repository type determination can be done by authenticated users
• Execution of git ls-remote commands using other workspaces' stored credentials is possible
• Verification of workspace isolation and access controls is necessary

Technical summary

The vulnerability exists in the /build/branch-list endpoint of Jpom, where an authenticated user can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials. This allows for unauthorized repository access and enumeration. Defenders should verify and remediate this vulnerability, focusing on restricting access to repository identifiers and ensuring proper workspace isolation. The vulnerability was discovered in Jpom through 2.11.12 and allows authenticated users to access repositories from other workspaces.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Jpom instances, focusing on restricting access to repository identifiers and ensuring proper workspace isolation.

Recommended defensive actions

• Verify Jpom version and check if it is vulnerable (2.11.12 or earlier)
• Restrict access to repository identifiers and ensure proper workspace isolation
• Monitor for suspicious activity on the /build/branch-list endpoint
• Apply patches or updates provided by the vendor, if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, additional information on affected versions and remediation steps is limited. The vulnerability was discovered in Jpom through 2.11.12 and allows authenticated users to access repositories from other workspaces. Defenders should verify the affected versions, check for patches or updates provided by the vendor, and ensure proper workspace isolation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.