CVE-2026-77125
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Sonatype Nexus Repository 3, two blobstore group management REST API endpoints did not correctly enforce authorization. A user with only nexus:blobstores:create permission could convert an existing blobstore into a group blobstore, an action requiring nexus:blobstores:update. This could lead to unauthorized modification of blobstore configuration.
Risk Assessment
Risk of unauthorized changes to storage configuration, potentially compromising repository integrity.
Recommendation
Apply vendor patches and review granted permissions.
Other vulnerabilities in Sonatype Nexus Repository
See all- CVE-2026-3199Critical
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.
- CVE-2026-77124High
In affected versions of Nexus Repository 3, the script execution endpoint did not verify whether script execution had been administratively disabled. An account with script-execution permission could continue to run previously-created scripts even after nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
- CVE-2026-10748High
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.
- CVE-2026-3329High
A vulnerability in Sonatype Nexus Repository allows a remote unauthenticated attacker to perform credential-guessing attacks against user accounts via authentication endpoints.
- CVE-2026-3438Medium
Sonatype Nexus Repository versions 3.0.0 through 3.90.2 contain a reflected cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.
Original NVD description (English source)
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.