Description
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.93.0 – < 3.98.0 | 3.98.0 |
Advisories 1
- WID-SEC-2026-4362 Sonatype Nexus Repository Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026