## Summary
CVE-2026-66375 describes a high-severity issue where a low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
## Technical Details
- The NVD summary indicates the weakness aligns with CWE-862 (missing authorization / improper control of protected resources).
- The affected behavior is described as permanent removal of protected internal metadata across repositories, implying an authorization or access-control failure that allows a user with limited privileges to trigger destructive actions.
- Attack prerequisites (from NVD):
- Network reachability (AV:N)
- Low complexity (AC:L)
- Low privileges required (PR:L)
- No user interaction (UI:N)
- Authenticated access is required (PR:L with AC:L, and NVD states “low-privilege authenticated user”).
## Affected
- The provided references do not include a product/version matrix specifically for CVE-2026-66375.
- The only versioned JFrog content in the references is for other CVEs (e.g., Artifactory advisory listings and release notes), so no definitive affected versions for this CVE can be stated from the supplied material.
## Impact
- Integrity impact: protected internal metadata can be permanently removed.
- Availability impact: removal of internal metadata across repositories can disrupt repository functionality.
- CVSS (from prompt): 8.1 with I:H and A:H.
## Mitigation
1. Restrict and review accounts with low privileges; ensure only necessary users can access the relevant Artifactory features.
2. Apply vendor guidance/patches for CVE-2026-66375 once identified in JFrog advisories (the provided references do not include the specific remediation for this CVE).
3. Monitor for suspicious metadata-deletion activity across multiple repositories by low-privilege users (specific detection indicators are not present in the provided references).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-862