{"id":"CVE-2026-120201","kind":"vulnerability","aliases":["CVE-2026-120201"],"related":[],"title":"Jpom: auth bypass via token header grants super-admin, then command execution","description":"Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.","summary":"Jpom, a server and script management tool, lets an unauthenticated attacker send a crafted JPOM-USER-TOKEN header that Hutool's condition parser treats as a query operator. The attacker gains super-administrator access and can then run commands through Jpom's script features.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hutool","java","jpom","other","self-hosted"],"not_affected_if":["jpom-outside-2.10.0-2.11.12","not-internet-exposed"],"how_to_check":"- Check the installed Jpom version (`2.10.0` through `2.11.12` are listed as affected)\n- Look for a Jpom instance reachable from untrusted networks","fix":"- Upgrade past `2.11.12` (the sources do not name the fixed version)","status":"open","published_at":"2026-10-31T18:17:07+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","triaged_at":"2026-10-31T18:38:36+00:00","updated_at":"2026-10-31T18:38:36+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-31T18:38:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade past `2.11.12` (the sources do not name the fixed version)","reach":"internet","title":"Jpom: auth bypass via token header grants super-admin, then command execution","impact":"high","summary":"Jpom, a server and script management tool, lets an unauthenticated attacker send a crafted JPOM-USER-TOKEN header that Hutool's condition parser treats as a query operator. The attacker gains super-administrator access and can then run commands through Jpom's script features.","audience":"businesses","category":"other","nicknames":[],"who_cares":["jpom","self-hosted","java","hutool"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker becomes super-admin and runs commands on the server","analyst_note":"Confirm the fixed version and whether default installs are affected; check the NVD entry and Jpom release notes.","how_to_check":"- Check the installed Jpom version (`2.10.0` through `2.11.12` are listed as affected)\n- Look for a Jpom instance reachable from untrusted networks\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["jpom-outside-2.10.0-2.11.12","not-internet-exposed"],"who_is_affected":"Teams running Jpom versions 2.10.0 through 2.11.12 that accept requests from networks they do not fully control. The sources do not say whether default configurations are exposed. unknown for further detail.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000695,"input_tokens":4161,"output_tokens":558,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120201':16A,19A '-2026':15A,18A '2.10.0':74C '2.11.12':76C 'access':62B,91C 'admin':10A 'administr':61B,90C 'allow':83C 'attack':37B,57B,85C,103C 'auth':2A 'authent':79C 'bypass':3A,80C 'command':12A,67B,123C 'condit':49B,95C,115C 'contain':77C 'craft':40B 'cve':14A,17A 'execut':13A,122C 'featur':72B,128C 'gain':58B,87C 'grant':7A 'header':6A,45B,102C 'host':26B 'hutool':20B,47B,113C 'inject':93C 'java':21B 'jpom':1A,22B,27B,42B,69B,73C,99C,125C 'jpom-user-token':41B,98C 'let':34B 'like':108C 'manag':32B 'null':111C 'oper':55B,120C 'parser':50B,116C 'queri':54B,94C 'run':66B 'script':31B,71B,127C 'self':25B 'self-host':24B 'send':38B,105C 'server':29B 'super':9A,60B,89C 'super-admin':8A 'super-administr':59B,88C 'token':5A,44B,101C 'tool':33B 'treat':51B,117C 'unauthent':36B,84C 'user':43B,100C 'valu':107C 'via':4A 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams running Jpom versions 2.10.0 through 2.11.12 that accept requests from networks they do not fully control. The sources do not say whether default configurations are exposed. unknown for further detail.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120201","severity":null,"published_at":"2026-10-31T18:17:07+00:00","modified_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","fetched_at":"2026-10-31T18:37:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}