What is CVE-2026-70550?

CVE-2026-70550 is a medium-severity vulnerability in Jfrog Artifactory, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-08-25.

How severe is CVE-2026-70550?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Jfrog Artifactory

CVE-2026-70550

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Jfrog Artifactory

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

reefs@jfrog.com (vendor-advisory)
reefs@jfrog.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-70550?: CVE-2026-70550 is a medium-severity vulnerability in Jfrog Artifactory, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-08-25.
How severe is CVE-2026-70550?: Medium severity. CVSS v3 base score is 6.5 out of 10.