JFrogCVE-2026-65616

JFrog artifactory: improper authorization

High8.8CVE-2026-65616 · Published Jul 27, 2026 · updated Jul 30, 2026

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

Affected versions

Package	Affected	Fixed in
artifactory Product	< 7.146.27	7.146.27

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-347

More JFrog advisories

Date	Advisory	Severity	Fixed in
Jul 27	JFrog artifactory: information disclosure Medium6.5Jul 27 CVE-2026-660187.146.34+1 more	Medium6.5	7.146.34+1 more
Jul 27	JFrog artifactory: server-side request forgery Medium6.5Jul 27 CVE-2026-656187.133.6	Medium6.5	7.133.6
Jul 27	JFrog artifactory: path traversal High8.8Jul 27 CVE-2026-659217.111.18+3 more	High8.8	7.111.18+3 more
Jul 27	JFrog artifactory: missing authorization High7.1Jul 27 CVE-2026-659227.111.18+3 more	High7.1	7.111.18+3 more
Jul 27	JFrog artifactory: server-side request forgery Medium6.8Jul 27 CVE-2026-659237.111.18+3 more	Medium6.8	7.111.18+3 more
Jul 27	JFrog artifactory: server-side request forgery Medium6.5Jul 27 CVE-2026-659247.111.18+3 more	Medium6.5	7.111.18+3 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.