{"api_version":"1","generated_at":"2026-08-25T23:08:25+00:00","cve":"CVE-2026-70550","urls":{"html":"https://cve.report/CVE-2026-70550","api":"https://cve.report/api/cve/CVE-2026-70550.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-70550","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-70550"},"summary":{"title":"Potential unauthorized access to private Composer repository metadata in JFrog Artifactory","description":"An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.","state":"PUBLISHED","assigner":"JFROG","published_at":"2026-08-25 16:17:08","updated_at":"2026-08-25 16:17:08"},"problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":[{"version":"3.1","source":"reefs@jfrog.com","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","name":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","refsource":"reefs@jfrog.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","name":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","refsource":"reefs@jfrog.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70550","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70550","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"jfrog","product":"artifactory","version":"affected 7.161.0 7.161.19 custom","platforms":[]},{"source":"CNA","vendor":"jfrog","product":"artifactory","version":"affected 7.146.0 7.146.29 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Khai Tran | OpenAI","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"artifactory","vendor":"jfrog","versions":[{"lessThan":"7.161.19","status":"affected","version":"7.161.0","versionType":"custom"},{"lessThan":"7.146.29","status":"affected","version":"7.146.0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Khai Tran | OpenAI"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.</p>"}],"value":"An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-25T15:22:53.484Z","orgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","shortName":"JFROG"},"references":[{"tags":["vendor-advisory"],"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories"},{"tags":["vendor-advisory"],"url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"}],"source":{"discovery":"EXTERNAL"},"title":"Potential unauthorized access to private Composer repository metadata in JFrog Artifactory"}},"cveMetadata":{"assignerOrgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","assignerShortName":"JFROG","cveId":"CVE-2026-70550","datePublished":"2026-08-25T15:22:53.484Z","dateReserved":"2026-08-04T18:29:25.512Z","dateUpdated":"2026-08-25T15:22:53.484Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-25 16:17:08","lastModifiedDate":"2026-08-25 16:17:08","problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"70550","Ordinal":"1","Title":"Potential unauthorized access to private Composer repository met","CVE":"CVE-2026-70550","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"70550","Ordinal":"1","NoteData":"An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.","Type":"Description","Title":"Potential unauthorized access to private Composer repository met"}]}}}