© 2026 vulntracker.io

CVE-2026-17594

Nexus Repository 3 - Authorization Bypass in Repository Creation

MEDIUM

4.9

CVSS Score

Published: August 7, 2026 at 04:07 PM UTC

Updated: September 22, 2026 at 05:21 PM UTC

1 product affected across 1 vendorNexus Repository Manager

Using Nexus Repository 3 by Sonatype?

Get instant alerts when new vulnerabilities affect Nexus Repository 3 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.9

Exploit prediction

EPSS 1.0%

SSVC

No known exploit

Description

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nexus Repository Manager · Sonatype

95%

3.0.0 ≤ v < 3.95.03.0.0 3.0.1 3.0.2 3.1.0 3.10.0 3.11.0 3.12.0 3.12.1 3.13.0 3.14.0 3.15.0 3.15.1 3.15.2 3.15.3 3.16.0 3.16.1 3.16.2 3.17.0 3.17.1 3.17.2 3.18.0 3.18.1 3.19.0 3.19.1 3.2.0 3.2.1 3.20.0 3.20.1 3.20.2 3.20.3 3.21.0 3.21.1 3.21.2 3.22.0 3.22.1 3.23.0 3.24.0 3.24.1 3.25.0 3.25.1 3.26.0 3.26.1 3.27.0 3.28.0 3.28.1 3.29.0 3.29.1 3.29.2 3.3.0 3.3.1 3.3.2 3.30.0 3.30.1 3.31.0 3.31.1 3.32.0 3.32.1 3.33.0 3.33.1 3.34.0 3.34.1 3.35.0 3.36.0 3.37.0 3.37.1 3.37.2 3.37.3 3.38.0 3.38.1 3.39.0 3.4.0 3.40.0 3.40.1 3.41.0 3.41.1 3.42.0 3.43.0 3.44.0 3.45.0 3.45.1 3.46.0 3.47.0 3.47.1 3.48.0 3.49.0 3.5.0 3.5.1 3.5.2 3.50.0 3.51.0 3.52.0 3.53.0 3.53.1 3.54.0 3.54.1 3.55.0 3.56.0 3.57.0 3.57.1 3.58.0 3.58.1 3.59.0 3.6.0 3.6.1 3.6.2 3.60.0 3.61.0 3.62.0 3.63.0 3.64.0 3.65.0 3.66.0 3.67.0 3.67.1 3.68.0 3.68.1 3.69.0 3.7.0 3.7.1 3.70.0 3.70.1 3.71.0 3.72.0 3.73.0 3.74.0 3.75.0 3.75.1 3.76.0 3.76.1 3.77.0 3.77.1 3.77.2 3.78.0 3.78.1 3.78.2 3.78.3 3.79.0 3.79.1 3.8.0 3.80.0 3.81.0 3.81.1 3.82.0 3.82.1 3.83.0 3.83.1 3.83.2 3.84.0 3.84.1 3.84.2 3.85.0 3.85.1 3.86.0 3.86.1 3.86.2 3.86.3 3.87.0 3.87.1 3.87.2 3.88.0 3.88.1 3.89.0 3.89.1 3.9.0 3.90.0 3.90.1 3.90.2 3.90.3 3.90.4 3.91.0 3.91.1 3.92.0 3.92.1 3.92.2 3.92.3 3.93.0 3.93.1 3.93.2 3.94.0 3.94.1

Affected range stops below 3.95.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

PatchRelease Notes

Source: cverecord

https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html

Vendor Advisory

Source: cverecord

https://support.sonatype.com/hc/en-us/articles/53851569407891/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.9MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: HIGH
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-863

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card