CVE-2026-70550CWE-862broken-access-control

CVE-2026-70550

Medium · published August 25, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-25T20:17Z
References (2)
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases · [email protected]https://docs.jfrog.com/releases/docs/jfrog-security-advisories · [email protected]
EPSS history
Timeline
  • 27 AUG 06:43Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:22Z
    Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
    cvelistv5