CVE-2026-70547

Awaiting Analysis Awaiting Analysis - Queue

Authenticated Access to Package Metadata in JFrog Artifactory

Publication date: 2026-08-12

Last updated on: 2026-09-11

Assigner: JFrog

Description

An authenticated user without repository read permission may access package metadata under specific conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-09-11

Generated

2026-09-22

AI Q&A

2026-08-12

EPSS Evaluated

2026-09-20

NVD

CVE-2026-70547

EUVD

EUVD-2026-57260

Affected Vendors & Products

Vendor	Product	Version / Range
jfrog	artifactory	From 7.161.0 (inc) to 7.161.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user without repository read permission to access package metadata under specific conditions. The access is limited to metadata and does not include the actual package content.

Detection Guidance

This vulnerability requires authenticated access without repository read permissions. Detection may involve reviewing user access logs for unauthorized metadata access attempts or monitoring for unusual package metadata queries from non-privileged accounts.

Impact Analysis

The impact is limited to unauthorized access to package metadata. This could lead to information leakage about available packages or versions without exposing sensitive data or package contents.

Compliance Impact

The vulnerability allows unauthorized access to package metadata, which could potentially expose sensitive information. This may impact compliance with regulations requiring strict access controls and data protection, such as GDPR or HIPAA, depending on the nature of the exposed metadata.

Mitigation Strategies

Implement strict access controls to ensure authenticated users have only necessary repository permissions. Review and restrict metadata access policies for users without read permissions.

Hi! I’m here to help you understand CVE-2026-70547. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70