An event-handling weakness in JFrog Artifactory can result in the accidental exposure of privileged authorization tokens to a user with lower privileges. The vulnerability arises when the system processes certain worker events, which can inadvertently leak tokens that grant elevated access. If an attacker gains access to these tokens, they can perform actions beyond their authorized scope, compromising data integrity and potentially gaining full control over the Artifactory instance.

The issue affects the JFrog Artifactory product. No specific version range is provided in the advisory, so all deployed instances that rely on the default event-handling mechanism are potentially impacted until a vendor fix is applied.

The CVSS score of 8.8 indicates a high severity, but the EPSS score of < 1% and the fact that it is not listed in CISA’s KEV catalog suggest that the risk of active exploitation is currently low. The likely attack vector involves interacting with the Artifactory event system, so an attacker would need some level of authenticated access or the ability to trigger events. Once the privileged token is exposed, the attacker could elevate their privileges and compromise the system. Regular monitoring for token leakage and rapid patching is recommended.