CVE-2026-65926 PUBLISHED

Private Release Bundle versions may be disclosed under specific configurations

Assigner: JFROG
Reserved: 23.07.2026 Published: 12.08.2026 Updated: 12.08.2026

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	jfrog
Product	artifactory
Versions	Default: unaffected affected from 0 to 7.146.35 (excl.) affected from 7.161.0 to 7.161.16 (excl.)

Credits

Khai Tran | OpenAI finder

References

https://docs.jfrog.com/releases/docs/jfrog-security-advisories
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Problem Types

CWE-862 Missing Authorization CWE