JFrog Artifactory Self‑Hosted releases prior to 7.133.11 incorrectly validate user tokens by checking the signature and issuer but not the scope. This flaw permits an attacker who has a valid token to use it with higher privileges than intended, allowing access to protected artifacts, administrative functions, or configuration data that the token’s scope normally forbids. The weakness is classified as CWE‑863 and can compromise confidentiality, integrity, and availability of the repository and any downstream services that rely on it.

All self‑hosted installations of JFrog Artifactory running versions earlier than 7.133.11. The issue is tied to the token authentication logic used in those releases.

The CVSS score of 8.1 signals a high severity vulnerability, and the EPSS score of < 1% indicates a very low exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. However, the vulnerability can be exploited by anyone who can obtain a token—either through compromised credentials or by crafting a token with a valid issuer. The attack path is straightforward: present a signed token that passes signature verification but omits the required scope, enabling the token to be recognized as fully privileged by Artifactory.