Vulnerability · Published Aug 25, 2026 · Assigned by JFROG
CVE-2026-70550Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
Medium 6.5
In plain English
A medium-severity missing authorization in artifactory from jfrog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 70.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jfrog | artifactory | 7.161.0 – before 7.161.197.146.0 – before 7.146.29 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N