Description
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jfrog | artifactory | 7.161.0 – < 7.161.19, 7.146.0 – < 7.146.29 | 7.161.19 |
Advisories 1
- WID-SEC-2026-3026 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 25, 2026
References
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories vendor-advisory
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases vendor-advisory