EUVD-2026-57243
GHSA-8p4r-xhj4-hcxq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable via standard HTTP; PR:L reflects required publisher authentication; no confidentiality or availability impact, only integrity; scope unchanged.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A repository publisher without delete permission may modify protected package content under specific conditions.
AnalysisAI
JFrog Artifactory contains a missing authorization flaw that allows an authenticated user holding a publisher role - but explicitly denied delete permissions - to modify protected package content under specific conditions. This integrity bypass (CWE-862) is reachable over the network without elevated privileges, making it a supply chain risk for organizations using Artifactory as their artifact repository. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
JFrog Artifactory is an enterprise artifact repository manager supporting fine-grained, per-repository permission sets - including separate deploy/write and delete grants. The flaw is classified as CWE-862 (Missing Authorization): the application fails to enforce a required authorization check for certain package-modification operations, allowing the write path to bypass protections that were intended to be enforced through delete-permission gating. The CPE cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* covers all self-managed Artifactory editions across all platforms, with no version boundary specified in the advisory data. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the vulnerability is exercisable over the network by any low-privileged (authenticated publisher) user without user interaction or complex preconditions.
RemediationAI
Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and upgrade to the patched Artifactory release identified in the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases - no specific fix version was confirmed in the input data, so check the release notes directly. As a compensating control prior to patching, review and audit all publisher-role accounts to ensure only trusted principals hold deploy/write permissions on protected repositories; restrict CI/CD service accounts to the minimum required repository scope. Additionally, enable Artifactory's artifact signing or checksum verification features where available so downstream consumers can detect tampered content independently of repository access controls. Note that access-scope reduction reduces attack surface but does not eliminate the underlying authorization bypass.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today