An incorrect authorization check on the signature of a refresh token allows an authenticated non‑administrator to acquire a signed token that grants JFrog administrator privileges. This flaw falls under CWE‑347 and results in the attacker gaining full control over repository configuration, user and permission management, and sensitive build data by virtue of the elevated privileges.

The affected product is JFrog Artifactory. The advisory references Artifactory self‑managed releases, but no specific version identifiers are provided, meaning any currently maintained Artifactory deployment is potentially vulnerable until an official fix is applied.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require an authenticated user who can request a refresh token, which could be achieved through legitimate UI or API access. If exploited, the attacker could obtain full system compromise due to the administrator token.