CVE-2026-65922

Published: Jul 27, 2026Modified: Jul 30, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.

Affected (6)

Products: Jfrog: Artifactory

Jfrog

1 product

Artifactory

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Jfrog Artifactory	Before 7.111.18
Jfrog Artifactory	From 7.117.0 to 7.117.25
Jfrog Artifactory	From 7.125.0 to 7.125.18
Jfrog Artifactory	From 7.133.0 to 7.133.27
Jfrog Artifactory	From 7.146.0 to 7.146.34
Jfrog Artifactory	From 7.161.0 to 7.161.15

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Source: reefs@jfrog.com

Release Notes

https://docs.jfrog.com/releases/docs/jfrog-security-advisories

Source: reefs@jfrog.com

Vendor Advisory

Timeline

No history available yet.