CVE-2026-65922

Analyzed Analyzed - Analysis Complete

Authorization Weakness in JFrog Artifactory Metadata Handling

Publication date: 2026-07-27

Last updated on: 2026-07-30

Assigner: JFrog

Description

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-30

Generated

2026-08-17

AI Q&A

2026-07-27

EPSS Evaluated

2026-08-15

NVD

CVE-2026-65922

EUVD

EUVD-2026-49583

Affected Vendors & Products

Vendor	Product	Version / Range
jfrog	artifactory	From 7.161.0 (inc) to 7.161.15 (exc)
jfrog	artifactory	to 7.111.18 (exc)
jfrog	artifactory	From 7.117.0 (inc) to 7.117.25 (exc)
jfrog	artifactory	From 7.125.0 (inc) to 7.125.18 (exc)
jfrog	artifactory	From 7.133.0 (inc) to 7.133.27 (exc)
jfrog	artifactory	From 7.146.0 (inc) to 7.146.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization weakness in JFrog Artifactory's internal metadata handling. It allows a user with limited repository access to write to restricted internal metadata areas under specific conditions. The impact is limited to integrity and availability at a low level, with no effect on confidentiality.

Detection Guidance

Detection requires reviewing Artifactory logs for unauthorized metadata write attempts. Check for users with limited repository access performing write operations to internal metadata paths. Review audit logs for suspicious activity patterns in restricted areas.

Impact Analysis

If exploited, this vulnerability could allow unauthorized modifications to internal metadata, potentially affecting system integrity and availability. However, confidentiality remains unaffected, and the impact is considered low.

Compliance Impact

This vulnerability primarily impacts data integrity and system availability rather than confidentiality, which may limit direct GDPR or HIPAA violations. However, unauthorized modifications to internal metadata could lead to compliance issues if it affects audit trails or data processing integrity required by these regulations.

Mitigation Strategies

Update JFrog Artifactory to the latest patched version immediately to address the authorization weakness in internal metadata handling. Review user permissions and repository access controls to ensure least privilege principles are enforced.

Hi! I’m here to help you understand CVE-2026-65922. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70