CVE-2026-42016 is an incorrect authorization vulnerability (CWE-863) in JFrog Artifactory (Self Hosted) versions prior to 7.133.11. The vulnerability occurs because the product validates the token signature and issuer but fails to validate the token's scope, enabling an attacker with limited privileges to escalate their privileges improperly. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

Successful exploitation of this vulnerability could allow an attacker with some privileges to escalate their access rights within the affected JFrog Artifactory instance. This could lead to unauthorized access to sensitive information and modification of data, impacting confidentiality and integrity. Availability is not affected. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected versions and monitor for suspicious activity related to token usage. Avoid using affected versions in sensitive environments where privilege escalation could have significant impact.