Description
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.0.0 – < 3.95.0 | 3.95.0 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch http/cves/2026/CVE-2026-17594.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2026-2713 Sonatype Nexus Repository Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026