EUVD-2026-57254
GHSA-gx5w-3352-3hcw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
PR:L confirmed by description; no confidentiality impact; AC:L despite 'specific conditions' language, as CVSS reporter (JFrog) assigned low complexity and no data refutes it.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
AnalysisAI
Permanent deletion of protected internal metadata across repositories in JFrog Artifactory is possible by any low-privilege authenticated user under specific, undisclosed conditions. The flaw stems from CWE-862 (Missing Authorization), where the platform fails to enforce access controls on a metadata-deletion pathway that should be restricted to privileged roles. With a CVSS score of 8.1 (High), this represents a significant integrity and availability risk - an attacker with only a standard user account can irreversibly destroy protected repository metadata, with no confidentiality exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
JFrog Artifactory is a universal artifact repository manager widely deployed in enterprise DevOps pipelines to manage binaries, packages, and build artifacts. The affected component governs internal metadata - properties, tags, or system-managed annotations attached to repository items - which are typically write-protected to prevent accidental or malicious tampering. The root cause is CWE-862 (Missing Authorization): the application executes a privileged delete operation on protected metadata without first verifying that the requesting user holds sufficient permissions. The 'Authentication Bypass' tag in the intelligence data suggests the authorization layer for this specific operation can be circumvented by a legitimately authenticated but low-privilege user, bypassing the intended access control model. The CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* uses a wildcard version field, indicating JFrog has not scoped the vulnerability to a specific version range in the NVD record - all tracked Artifactory versions should be treated as potentially affected until the vendor advisory specifies otherwise.
RemediationAI
Upgrade JFrog Artifactory to the fixed version identified in the vendor's security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases. No specific patch version number is confirmed in the available intelligence data, so the exact fixed release must be verified directly from the JFrog advisory before upgrading. As an interim compensating control, restrict Artifactory user accounts to the minimum necessary permissions - specifically, audit and revoke any non-administrative accounts that have write or delete access to repository metadata endpoints. Additionally, enable Artifactory's audit logging to monitor for unexpected metadata deletion events, which can serve as a detection mechanism if exploitation occurs prior to patching. For highly sensitive repositories, consider temporarily restricting user account creation or placing the Artifactory instance behind an authenticated proxy that limits access to known-trusted principals, accepting the operational trade-off of reduced developer self-service.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today