Executive brief
JFrog Artifactory, a platform used by organizations to manage and distribute software packages, contains a security vulnerability that allows certain users to gain unauthorized administrative control. An attacker with an existing account provisioned by an administrator could exploit this flaw to temporarily elevate their permissions to full platform administrator status. This could allow an unauthorized user to modify system settings, access sensitive software artifacts, or disrupt development operations.
Technical details
An improper privilege management vulnerability (CWE-269) exists in the JFrog Platform, specifically affecting Artifactory Self-Managed deployments. The flaw allows an authenticated user, under specific admin-provisioned account conditions, to escalate their privileges to a temporary platform administrator. The attack vector is network-based and requires high privileges (PR:H) to initiate, but does not require user interaction. The vulnerability has been addressed in Artifactory versions 7.146.34 and 7.161.15.
Affected products
- JFrog Artifactory Self-Managed 7.146.0 to 7.146.33, 7.161.0 to 7.161.14
Timeline
- 2026-07-27: advisory: Initial advisory published by JFrog and NVD record created.
- 2026-07-27: patched: Fix released in Artifactory 7.161.15 and 7.146.34.