EUVD-2026-49566
GHSA-58cv-8cfm-c8r8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker needs a valid low-privilege token (PR:L) reachable over the network (AV:N) with no interaction; missing scope check grants broad repository read/write, so C/I/A High.
Primary rating from Vendor (JFROG).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
AnalysisAI
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).
Technical ContextAI
Artifactory is a binary/artifact repository manager widely used as the central store for build outputs, container images, and package dependencies in CI/CD pipelines. Access to its REST API and repositories is mediated by signed access tokens that carry a scope defining which repositories and actions the bearer may use. The flaw is a classic CWE-863 (Incorrect Authorization): the token verification path checks that the token is cryptographically valid (correct signature) and issued by a trusted issuer, but omits the authorization step of confirming the requested operation falls within the token's granted scope. As a result, a structurally valid token is treated as fully authorized regardless of the narrow permissions it was actually minted with. The affected CPE is cpe:2.3:a:jfrog:artifactory, specifically the Self-Hosted (self-managed) distribution.
RemediationAI
Vendor-released patch: upgrade JFrog Artifactory Self-Hosted to version 7.133.11 or later, which corrects the token validation to enforce scope; consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases for the exact upgrade path. Because exploitation requires a valid issued token, interim compensating controls include rotating or revoking existing access tokens and reissuing them with the tightest necessary scope, shortening token lifetimes to reduce the window of abuse, and reviewing access logs for tokens being used against repositories or actions outside their intended scope; restrict Artifactory API exposure to trusted networks to limit which authenticated identities can reach the endpoints. The trade-off of aggressive token rotation is temporary disruption to CI/CD jobs that authenticate with those tokens, so stage the rotation alongside pipeline configuration updates.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today