EUVD-2026-57255
GHSA-6f7v-qw6v-g527
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Downgraded AC to H because description explicitly requires specific undisclosed conditions; PR:L confirmed by authenticated low-privileged user requirement; no integrity or availability impact.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A low-privileged authenticated user may access restricted support information under specific conditions.
AnalysisAI
Unauthorized access to restricted support information in JFrog Artifactory allows a low-privileged authenticated user to read sensitive support data under specific, undisclosed conditions. The vulnerability stems from missing authorization controls (CWE-862) on support-related endpoints, exposing information that should be restricted to administrative roles. No public exploit has been identified at time of analysis, and no CISA KEV listing was found.
Technical ContextAI
JFrog Artifactory is a widely-deployed enterprise binary repository manager used to store and manage build artifacts across development pipelines. The affected component involves access control enforcement on internal support or diagnostic information endpoints. CWE-862 (Missing Authorization) indicates that the application fails to verify whether the authenticated user has the necessary permissions before granting access to the restricted resource - the authentication step is performed, but the authorization step that checks role or privilege level is absent or bypassable under specific conditions. The CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* with a wildcard version field indicates the issue affects all known Artifactory versions at the time of publication, spanning both self-managed and potentially cloud-hosted deployments.
RemediationAI
Patch available per vendor advisory; consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories for the specific fixed version, as no exact patch version was provided in the available intelligence. Additionally, review the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases to identify the first patched release and upgrade accordingly. As a compensating control pending patching, administrators should audit and restrict which internal network segments and user accounts have access to the Artifactory instance, applying the principle of least privilege to minimize the population of low-privileged users who could trigger the condition. Disabling or restricting access to support or diagnostic endpoints at the network perimeter or via Artifactory's access control configuration, if such granular controls exist, may reduce exposure, though this could impact legitimate support workflows.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today