GCVE-110-NCSC-2026-272

Advisory PublishedCVSS 8.1/10

Vulnetix · Advisory published July 31, 2026

JFrog Artifactory (Self Hosted) versions prior to 7.133.11 are susceptible to privilege escalation due to improper validation of token scope despite verifying token signature and issuer.

Download JSON Open in Console

Weaknesses (CWE)

CWE-863Incorrect AuthorizationCWE-347Improper Verification of Cryptographic SignatureCWE-502Deserialization of Untrusted DataCWE-918Server-Side Request Forgery (SSRF)CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-862Missing Authorization

Risk Scores

CVSS 3.1

8.1/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions	Platforms
JFrog	vers:unknown/*	—	—

Aliases

CVE-2026-42016 CVE-2026-42017 CVE-2026-65616 CVE-2026-65617 CVE-2026-65618 CVE-2026-65921 CVE-2026-65922 CVE-2026-65923 CVE-2026-65924 CVE-2026-65925 CVE-2026-66014 CVE-2026-66015 CVE-2026-66018

References

advisory

Browse GCVE Records

3,425 records in the GCVE database · Updated September 6, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON