Nexus Repository 3 Permission Misassignment Enables Privilege Escalation
CVE-2026-97712 Published on October 15, 2026
Nexus Repository 3 - Privilege Escalation via Role Management
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
Vulnerability Analysis
CVE-2026-97712 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-97712 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-97712
Want to know whenever a new CVE is published for Sonatype Nexus Repository Manager? stack.watch will email you.
Affected Versions
Sonatype Nexus Repository 3:- Version 3.0.0 and below 3.97.0 is affected.