CVE-2026-65616 - Potential privilege escalation to JFrog administrator privileges

HIGH

Potential privilege escalation to JFrog administrator privileges

Published Jul 27, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.37%

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jfrog	Artifactory	unaffected	Affected ≥ 0, < 7.146.27

No remediation recorded yet.

Weaknesses (1)

CWE-347

Link	Providers	Tags
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases		vendor-advisoryRelease Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories		vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49576		Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner JFROG

Published Jul 27, 2026

Updated Jul 27, 2026

Reserved Jul 22, 2026

CISA Vulnrichment

Updated Jul 27, 2026

NVD

Status Analyzed

Modified Jul 30, 2026

Red Hat

No data

ENISA EUVD

Assigner JFROG

Published Jul 27, 2026

Updated Jul 27, 2026

GitHub

No data