CVE-2026-70550: 
Artifactory Analyse et atténuation des vulnérabilités

CVE-2026-70550 is an authorization weakness (Missing Authorization, CWE-862) in JFrog Artifactory's Composer repository handling that may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to access. It was published on August 25, 2026, and affects Artifactory self-managed versions 7.161.0 through 7.161.11 and 7.146.0 through 7.146.29 (versions prior to 7.146.29 in the 7.146 branch). The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (JFrog Advisory, Github Advisory).

The root cause is classified as CWE-862 (Missing Authorization): Artifactory fails to properly enforce repository-level read permissions when handling certain Composer package metadata requests. An authenticated, low-privileged user can send network requests to Composer repository endpoints and receive package metadata responses from repositories for which they have no explicit read authorization, under specific (undisclosed) conditions. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (JFrog Advisory, Github Advisory).

Successful exploitation results in unauthorized disclosure of Composer package metadata from restricted repositories, impacting confidentiality only — there is no integrity or availability impact. An authenticated attacker with low privileges could enumerate package names, versions, and associated metadata from repositories they should not have access to, potentially exposing sensitive internal dependency information or proprietary package details. The scope is limited to the affected Artifactory instance and does not directly enable lateral movement or code execution (JFrog Advisory, Github Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid authentication credentials (low-privileged user), limiting the attack surface compared to unauthenticated vulnerabilities (Github Advisory, JFrog Advisory).

JFrog has released patched versions addressing this vulnerability. Self-hosted users should upgrade to Artifactory 7.161.19 (for the 7.161.x branch) or 7.146.36 (for the 7.146.x branch). JFrog Cloud environments have already been automatically patched and require no action. No configuration-based workaround is documented; upgrading to a fixed version is the recommended remediation. Additionally, reviewing and tightening repository-level access controls and auditing user permissions for Composer repositories is advisable as a defense-in-depth measure (JFrog Advisory, Artifactory Releases).

JFrog disclosed this vulnerability as part of a broader batch of security advisories published on August 25, 2026, covering multiple Artifactory CVEs of varying severity. No notable independent researcher commentary, social media discussion, or significant media coverage specific to CVE-2026-70550 has been identified beyond standard vulnerability aggregator listings (JFrog Advisory).