CVE-2026-17601

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.

CVSS 4.0

8.9CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

CVSS 3.1

7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-25)

CWE

CWE-862

Published

2026-08-07

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

Affected

• sonatype:nexus_repository_manager

References

• https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
• https://support.sonatype.com/hc/en-us/articles/53889365883539/

Check your stackJSON