An authenticated user can view private Puppet module metadata in JFrog Artifactory without having repository read access. The flaw is a missing authorization check (CWE-862), allowing the disclosure of internal metadata that may aid attackers in enumerating repository contents or planning further attacks. The vulnerability does not expose the actual module files, but it does provide privileged viewers with sensitive structural information about private Puppet modules.

JFrog Artifactory, as represented by the CNA vendor/product jfrog:artifactory. No specific version range is provided in the advisory; affected deployments are assumed to be current releases prior to the vendor’s fix.

The CVSS score of 4.3 indicates a moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalogue, suggesting that widespread exploitation has not been reported. The likely attack vector is an authenticated user exploiting the missing authorization check; an attacker must first obtain credentials for some user account. Because the effect is limited to metadata disclosure, the risk is primarily to confidentiality and limited to users who have already been authenticated.