This vulnerability allows a user with read access to a standard repository in JFrog Artifactory to retrieve environment properties from a protected build in a different repository. The flaw results in exposure of sensitive build environment secrets to unauthorized actors, classified under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low complexity and no user interaction required, but limited to confidentiality impact only. No integrity or availability impacts have been demonstrated. The affected versions explicitly include 7.146.0 and 7.161.0. There is no vendor advisory indicating an available patch or mitigation, and no known exploits in the wild have been reported.

Confidential build environment secrets can be exposed to unauthorized users who have read access to a different repository. This compromises confidentiality but does not affect integrity or availability of the system or data. The exposure could lead to leakage of sensitive information used in build processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict read access permissions carefully to trusted users only to minimize exposure risk.