Privilege Escalation via Wildcard Privilege Tampering in Nexus Repo
CVE-2026-17601 Published on August 7, 2026
Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.
Vulnerability Analysis
CVE-2026-17601 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-17601 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-17601
Want to know whenever a new CVE is published for Sonatype Nexus Repository Manager? stack.watch will email you.
Affected Versions
Sonatype Nexus Repository 3:- Version 3.19.0 and below 3.95.0 is affected.