CVE-2026-17594

8.2 highEPSS 1.0%

High (8.2) in sonatype nexus repository manager. EPSS 1.0% chance of exploitation in the next 30 days.

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

Severity

CVSS 4.0

8.2 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-08-07
Modified: 2026-09-22
Record from: the NVD, synced 2026-10-19

Affected

sonatype:nexus_repository_manager

References

Check your stack JSON