CVE-2026-69104: CWE-862 Missing Authorization in jfrog artifactory

This vulnerability in JFrog Artifactory (CVE-2026-69104) allows an authenticated user to initiate repository migration operations without proper authorization checks. The missing authorization can result in unauthorized information disclosure, changes to repository state, and disruption of service. The CVSS 3.1 base score is 7.6, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability. The affected version explicitly stated is 7.161.0. Although fixed versions are mentioned, no specific patch or remediation details are provided in the input data.

An attacker with authenticated access but without the required repository permissions may exploit this vulnerability to disclose sensitive information, alter repository state unauthorizedly, and disrupt service availability. This can compromise the confidentiality, integrity, and availability of the affected Artifactory instance.

Fixed versions addressing this vulnerability exist; users should upgrade to a version later than 7.161.0 once available. Since no official patch or remediation level is specified in the vendor advisory content, check JFrog's official advisories for the exact fixed versions and apply updates accordingly. Until patched, restrict authenticated user permissions to minimize exposure to unauthorized repository migration operations.