CVE-2026-97666

Sonatype Nexus Repository 3 allows a user holding the role create or role update permission to grant roles and privileges that the account does not hold. This can lead to privilege escalation up to full administrative access.

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user.

Nexus Repository 3 lacks an authorization check in the NuGet Components API upload path, allowing an account with only repository read and browse privileges to upload NuGet symbol packages (.snupkg). Exploitation requires a hosted NuGet repository with Symbol Server enabled, and with anonymous access enabled this precondition is met by default.

In Sonatype Nexus Repository 3, two blobstore group management REST API endpoints did not correctly enforce authorization. A user with only nexus:blobstores:create permission could convert an existing blobstore into a group blobstore, an action requiring nexus:blobstores:update. This could lead to unauthorized modification of blobstore configuration.

In affected versions of Nexus Repository 3, the script execution endpoint did not verify whether script execution had been administratively disabled. An account with script-execution permission could continue to run previously-created scripts even after nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

A vulnerability in Sonatype Nexus Repository allows a remote unauthenticated attacker to perform credential-guessing attacks against user accounts via authentication endpoints.

In Sonatype Nexus Repository versions 3.6.0 through before 3.92.0, an authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript execution in the browser of any user browsing that repository directory via the HTML index page. This could allow the attacker to perform actions in the context of the victim's session.

Sonatype Nexus Repository versions 3.0.0 through 3.90.2 contain a reflected cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.