EUVD-2026-57260
GHSA-pqw8-h4c8-xg3j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible by any authenticated user (PR:L, AV:N); impact confined to metadata read only, yielding C:L with no integrity or availability consequence.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user without repository read permission may access package metadata under specific conditions.
AnalysisAI
Package metadata authorization bypass in JFrog Artifactory 7.161.0 through 7.161.15 allows authenticated low-privileged users to read package metadata from repositories they are explicitly denied read access to, under specific undisclosed conditions. The flaw is a missing authorization check (CWE-862) in the metadata access path, creating an unintended privilege boundary crossing within Artifactory's permission model. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified, but the network-accessible attack vector with no user interaction required makes this relevant for any multi-tenant or externally accessible Artifactory deployment.
Technical ContextAI
JFrog Artifactory is an enterprise-grade universal artifact repository manager widely used in DevOps and CI/CD pipelines to host packages across formats including Maven, npm, Docker, PyPI, Helm, and others. The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaw where the application omits or improperly gates an authorization decision before serving a resource. In this case, the metadata retrieval layer for packages fails to enforce the repository-level read ACL under certain triggering conditions, despite the permission model otherwise enforcing these boundaries. The affected CPE is cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*, scoped by ENISA EUVD-2026-57260 to the 7.161.x release line from 7.161.0 through 7.161.15. Metadata exposure in Artifactory can reveal package names, versions, dependency trees, internal artifact identifiers, and build provenance - information that may be sensitive in proprietary or regulated environments.
RemediationAI
Upgrade JFrog Artifactory to version 7.161.16 or later, which contains the vendor-released patch addressing this authorization bypass. Consult the vendor release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases and the security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories for upgrade instructions. If immediate patching is not feasible, consider restricting Artifactory network access to trusted IP ranges or VPN-only segments to reduce the attack surface - note this does not eliminate risk from already-authenticated internal users. Additionally, audit current user permission assignments to ensure accounts hold least-privilege access and that no accounts have broader authentication scope than operationally required. Be aware that restricting network access is a compensating control only; it does not address the root missing authorization check and must be followed by patching.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today