CVE-2026-66377

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Repository Information Disclosure

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: JFrog

Description

An unauthenticated user may access restricted repository information under specific conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-66377

EUVD

EUVD-2026-57246

Affected Vendors & Products

Vendor	Product	Version / Range
jfrog	artifactory	7.161.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated user to access restricted repository information under specific conditions. It does not require authentication or user interaction but has limited impact as it only exposes information without altering data or causing denial of service.

Detection Guidance

Since this is an unauthenticated access issue to restricted repository information, detection may involve checking network traffic for unusual requests to repository endpoints. Monitor logs for unauthorized access attempts or data exfiltration. Use tools like curl to test repository endpoints for exposed data without authentication.

Impact Analysis

The impact is limited to unauthorized information disclosure. Attackers could view sensitive repository details but cannot modify, delete, or disrupt services. The risk is low due to the lack of data alteration or system compromise.

Compliance Impact

The vulnerability allows unauthenticated access to restricted repository information, which could lead to unauthorized data exposure. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to sensitive data.

Mitigation Strategies

Update to the latest version of the affected software to patch the unauthorized access vulnerability. Review repository access controls and ensure proper authentication is enforced for all users.

Hi! I’m here to help you understand CVE-2026-66377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70