EUVD-2026-43750
GHSA-3v8f-7593-ph9g
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse privileges on a Swift, Terraform, or Conda hosted repository push arbitrary artifacts, defeating the intended write-permission check (CWE-862). The flaw affects the specific upload paths for these three formats and enables unauthorized artifact publishing that can poison downstream builds. No public exploit identified at time of analysis; Sonatype has shipped a fix in release 3.94.0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Nexus Repository 3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (Sonatype) · only source for this CVE.
CVSS VectorVendor: Sonatype
DescriptionCVE.org
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.
Executive ViewAI
Sonatype Nexus Repository 3 contains an authorization bypass enabling users with read-only access to inject arbitrary artifacts into Swift, Terraform, and Conda repositories, creating a direct supply chain compromise risk. Organizations relying on Nexus 3 for these package formats face potential pollution of downstream builds and production applications if malicious components are published upstream. Immediate patching to version 3.94.0 is required to prevent artifact poisoning attacks.
Within 24 hours, inventory all Sonatype Nexus Repository 3 instances across infrastructure and confirm which ones host Swift, Terraform, or Conda repositories. Within 7 days, upgrade all affected Nexus 3 deployments to version 3.94.0 or later, prioritizing production systems first. Within 30 days, review complete artifact upload logs and audit trails from the period before patching; investigate any suspicious component pushes from read-only account holders and rotate credentials for accounts that held read access during the vulnerable window.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user who holds the 'role create' or 'role up
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Sonatype Nexus Repository 3 fails to enforce a write-authorization check on the NuGet symbol-package upload path, lettin
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Java class-enumeration through the ExtDirect endpoint in Sonatype Nexus Repository 3 allows an unauthenticated, remote a
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
Exploit-DB