EUVD-2026-49566
GHSA-58cv-8cfm-c8r8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker needs a valid low-privilege token (PR:L) reachable over the network (AV:N) with no interaction; missing scope check grants broad repository read/write, so C/I/A High.
Primary rating from Vendor (JFROG).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
AnalysisAI
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess a legitimately issued, cryptographically valid Artifactory access token (CVSS PR:L confirms an authenticated, low-privileged starting position) - this is the exact prerequisite, since the vulnerable path accepts any correctly signed token from a trusted issuer regardless of its scope. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and point to a genuine but not urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer or automation account is issued a narrowly scoped Artifactory token - for example, read-only access to a single repository. Because Artifactory validates only the token's signature and issuer and not its scope, the holder replays that token against privileged API endpoints or other repositories and gains write or administrative-level access it was never granted. … |
| Remediation | Vendor-released patch: upgrade JFrog Artifactory Self-Hosted to version 7.133.11 or later, which corrects the token validation to enforce scope; consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases for the exact upgrade path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all JFrog Artifactory Self-Hosted deployments and determine which versions are currently deployed; audit authentication logs for anomalous token usage patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Artifactory
View allAn issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met
Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain
Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by explo
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today