CVE-2026-70550

Published: Aug 25, 2026Modified: Aug 28, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: reefs@jfrog.com (Secondary)

Description

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Source: reefs@jfrog.com

https://docs.jfrog.com/releases/docs/jfrog-security-advisories

Source: reefs@jfrog.com

Timeline

No history available yet.