JFrogCVE-2026-66377

JFrog artifactory: missing authorization

Medium5.3CVE-2026-66377 · Published Aug 12, 2026 · updated Sep 2, 2026

An unauthenticated user may access restricted repository information under specific conditions.

Affected versions

Package	Affected	Fixed in
artifactory Product	< 7.146.35	7.146.35
	>= 7.161.0, < 7.161.16	7.161.16

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-862

More JFrog advisories

Date	Advisory	Severity	Fixed in
Aug 12	JFrog artifactory: improper input validation High8.8Aug 12 CVE-2026-691067.146.28	High8.8	7.146.28
Aug 12	JFrog artifactory: improper authentication High7.5Aug 12 CVE-2026-420187.111.20+3 more	High7.5	7.111.20+3 more
Aug 12	JFrog artifactory: missing authorization Medium4.3Aug 12 CVE-2026-705477.161.16	Medium4.3	7.161.16
Aug 12	JFrog artifactory: insufficient authenticity check High8.1Aug 12 CVE-2026-691057.161.16	High8.1	7.161.16
Aug 12	JFrog artifactory: missing authorization Medium5.9Aug 12 CVE-2026-691077.104.16+3 more	Medium5.9	7.104.16+3 more
Aug 12	JFrog artifactory: improper signature check High7.2Aug 12 CVE-2026-687597.146.35+1 more	High7.2	7.146.35+1 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.