EUVD-2026-57245
GHSA-v7m3-mxh9-fx63
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Bundle writer is a low-privilege authenticated role accessed over the network; impact is limited to release metadata integrity with no confidentiality or availability effect.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A bundle writer may create misleading release promotion information under specific conditions.
AnalysisAI
Incorrect authorization (CWE-863) in JFrog Artifactory allows an authenticated bundle writer to generate misleading release promotion metadata under specific operating conditions, undermining the integrity of the software release pipeline. Affected scope spans all Artifactory versions per the wildcard CPE string, impacting both self-managed and potentially cloud deployments where the bundle writer role is in use. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog, though the supply-chain integrity risk in production DevSecOps pipelines may exceed the moderate CVSS score.
Technical ContextAI
JFrog Artifactory is a universal artifact repository manager central to DevOps CI/CD pipelines, used to store, manage, and promote software build artifacts and release bundles across deployment environments. The Release Bundle promotion workflow governs which users can advance artifacts through promotion gates (e.g., dev → staging → production). CWE-863 (Incorrect Authorization) indicates that authorization checks exist for the bundle writer role but are implemented incorrectly, permitting that role to generate or record release promotion information beyond its intended authorization boundary. The CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* carries a fully open version range with no upper bound, indicating the vendor has not yet scoped the affected versions in machine-readable form - exact boundaries must be obtained from the JFrog advisory directly.
RemediationAI
Upgrade to the patched version of JFrog Artifactory as identified in the official release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases and the security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories. No exact fixed version number is independently confirmed from available input data - the precise minimum safe version must be sourced directly from JFrog. As a compensating control before patching, audit all accounts holding the bundle writer role and reduce membership to the minimum required set; this limits the pool of principals that can trigger the flaw. Enable and actively monitor Artifactory audit logs for unexpected release promotion events, as anomalous promotion activity would be the primary observable indicator of exploitation. Restricting bundle promotion API endpoints at the network layer to known CI/CD service account source IPs adds an additional layer of control without affecting standard workflows.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today