Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-70550

Potential unauthorized access to private Composer repository metadata in JFrog Artifactory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jfrog artifactory

Default version status: unaffected

  • 7.161.0 to < 7.161.19affected
  • 7.146.0 to < 7.146.29affected

References