Advisoriesby IbisJFrogCVE-2026-70550
JFrog artifactory: missing authorization
Fix: upgrade to 7.161.19 or later (2 fixed versions below)
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| artifactory Product | >= 7.161.0, < 7.161.19 | 7.161.19 |
| >= 7.146.0, < 7.146.29 | 7.146.29 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-862