Jpom CVE-2026-120461

Requires an authenticated Jpom account that already holds SSH command execute permission in at least one workspace (PR:L), and a multi-workspace deployment where SSH command templates and SSH nodes exist in other workspaces. The attacker must supply foreign template and node IDs to POST /node/ssh_command/batch, which resolves them by ID without workspace ownership checks. Limiting factors: no anonymous access (valid low-privilege credentials needed), the attack only yields value in multi-tenant/multi-workspace setups, and it depends on the target workspaces having stored SSH credentials and configured command templates; no special non-default configuration or user interaction is otherwise required.

This is a genuine high-priority issue rather than an inflated high-CVSS score, though it is not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: a network-reachable endpoint, low attack complexity, low privileges required, no user interaction, and full compromise (confidentiality, integrity, availability) of the targeted SSH hosts via arbitrary command execution. The vuln.today decision label is 'this_week', which aligns with a serious but authentication-gated flaw rather than 'act_now'/'emergency'. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided, so there is no evidence of active exploitation - the real-world risk is driven by impact severity and ease of use for an already-authenticated insider, not by observed in-the-wild activity. The key limiting signal is PR:L: the attacker must already hold a Jpom account with SSH command execute permission in at least one workspace, so this is primarily an insider/multi-tenant privilege-escalation and lateral-movement risk rather than a fully anonymous remote takeover. Missing data to note explicitly: EPSS exploitation probability is absent, KEV status is absent (treat as not listed), and PoC availability is not confirmed in the input.

A low-privileged but authenticated Jpom user who holds SSH command execute permission in Workspace A obtains or guesses command-template and SSH-node IDs belonging to Workspace B, then sends a POST /node/ssh_command/batch request supplying those foreign IDs. Because the endpoint resolves templates and nodes by ID without workspace filtering, Jpom runs the attacker's commands on Workspace B's SSH hosts using the stored credentials, giving cross-tenant command execution. No public exploit code is confirmed in the available data, but the vendor patch commit and vulnerable source lines are publicly referenced.