Which versions of Nexus Repository 3 are affected by EUVD-2026-54520?

Nexus Repository 3 (versions 3.0.0-3.94.x) contains an authorization flaw that allows authenticated administrators to create repository types outside their assigned scope, introducing the risk of…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-54520?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54520. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-54520?

Within 24 hours, identify all Nexus Repository instances running versions 3.0.0 through 3.94.x and document current user role assignments and repository-creation permissions. Within 7 days, deploy version 3.95.0 across all affected instances to resolve the authorization bypass. Within 30 days, audit repository creation logs for the past 90 days to identify any unauthorized repositories that may have been created, validate that privilege scoping is functioning as intended, and document any remediation of artifacts introduced by unauthorized repository creation.

Nexus Repository 3 EUVD-2026-54520

Q: What is the CVSS score of EUVD-2026-54520?

EUVD-2026-54520 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-17594 HIGH

Incorrect Authorization (CWE-863)

2026-08-07 Sonatype

GHSA-9x3v-rxwx-3gx2

Authentication Bypass Nexus Repository 3 Sonatype

8.2

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network delivery with high privileges required; scope changes because unauthorized repository formats are created beyond the user's legitimate scope boundary.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Threat Model Generated

Aug 31, 2026 - 11:31 vuln.today

Analysis Generated

Aug 07, 2026 - 16:47 vuln.today

CVE Published

Aug 07, 2026 - 16:07 cve.org

HIGH 8.2

DescriptionCVE.org

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

AnalysisAI

Incorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a format-scoped delegated repository-admin privilege to create repositories in unauthorized formats - bypassing the intended scope boundary. Affected are all releases from 3.0.0 through 3.94.x; version 3.95.0 resolves the flaw. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is high given that unauthorized repository types could be introduced into a managed artifact store, potentially tainting software supply chain pipelines.

Technical ContextAI

Sonatype Nexus Repository 3 (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*) is an artifact repository manager supporting multiple formats such as Maven, npm, Docker, PyPI, and others. The platform supports a delegated privilege model where administrators can grant users repository-admin rights scoped to a particular format. The root cause is CWE-863 (Incorrect Authorization): the repository-creation endpoint evaluates authorization against one request parameter (the format field used for the access control decision) while the actual repository format instantiated is derived from a separate, independently supplied field in the same request. This parameter confusion allows the authorization check to pass for a permitted format while a different, unauthorized format is created on the backend - a classic server-side request field substitution bypass.

RemediationAI

The primary remediation is upgrading to Nexus Repository 3 version 3.95.0 or later, where Sonatype has corrected the authorization logic to ensure both the decision field and the format instantiation field are evaluated against the same privilege scope. Upgrade guidance and release notes are available at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html. As a compensating control prior to patching, organizations should audit and minimize delegated repository-admin privilege grants: removing format-scoped repository-admin rights from accounts that do not operationally require them eliminates the vulnerable privilege condition entirely. Additionally, restricting access to the repository-creation UI via network policy or role-based controls to only fully trusted administrators limits exposure. Note that revoking delegated privileges may disrupt team-level self-service repository workflows, so this trade-off should be evaluated against the patching timeline.