EUVD-2026-70228
GHSA-mgww-mhp8-f89c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network REST API, low complexity; PR:L because the create permission must be explicitly granted; no confidentiality or availability impact, only blobstore config integrity.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.
AnalysisAI
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the nexus:blobstores:create permission to invoke two blobstore group management REST API endpoints that should instead require nexus:blobstores:update. By calling these endpoints, the user can convert any existing blobstore into a group blobstore - a structural configuration change - without administrator approval. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid Nexus Repository account that has been explicitly granted the `nexus:blobstores:create` named permission by an administrator - this permission is not assigned by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1 (High), reflecting a network-accessible, low-complexity attack requiring only low privileges with no user interaction and a high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Sonatype Nexus Repository 3.96.0 or later, where the blobstore group management endpoints have been corrected to require the `nexus:blobstores:update` permission. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Nexus Repository 3 in your environment and inventory users holding the nexus:blobstores:create permission. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - hold
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today