CVE-2026-77125: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-77125 is an Incorrect Authorization vulnerability in Sonatype Nexus Repository 3 affecting versions 3.19.0 through 3.95.x (fixed in 3.96.0). Two blobstore group management REST API endpoints failed to correctly enforce authorization checks, allowing a user with only the nexus:blobstores:create permission to perform actions that should require the nexus:blobstores:update permission — specifically, converting an existing blobstore into a group blobstore without administrator approval. The vulnerability was published on September 2, 2026, and carries a CVSS v4.0 base score of 7.1 (High) (Github Advisory, Sonatype Release Notes).

The root cause is classified as CWE-863 (Incorrect Authorization): the affected REST API endpoints perform an authorization check but do not correctly validate that the caller holds the nexus:blobstores:update permission before allowing blobstore conversion operations. An attacker with a low-privilege account that has been explicitly granted the nexus:blobstores:create permission can send crafted API requests to the blobstore group management endpoints to convert an existing blobstore into a group blobstore — an administrative action. The attack is network-accessible, requires no user interaction, and has low attack complexity, though it does require the attacker to already possess the nexus:blobstores:create permission (which is not held by default and must be explicitly granted by an administrator) (Github Advisory).

Successful exploitation allows an authenticated user with limited privileges to unauthorized modify blobstore configuration — specifically converting existing blobstores into group blobstores — without administrator approval. The primary impact is to integrity (CVSS VI:High), with no direct confidentiality or availability impact on the vulnerable system or subsequent systems. In practice, unauthorized blobstore reconfiguration could disrupt artifact storage operations, redirect artifact storage to unintended locations, or undermine the integrity of the software supply chain managed by the Nexus Repository instance (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.215% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to authenticated users who have been explicitly granted the nexus:blobstores:create permission, reducing the overall attack surface.

1. Obtain credentials: Acquire credentials for a Nexus Repository 3 account that has been explicitly granted the nexus:blobstores:create permission by an administrator.
2. Identify target instance: Locate a Nexus Repository 3 instance running a version between 3.19.0 and 3.95.x.
3. Enumerate existing blobstores: Use the Nexus Repository REST API (e.g., GET /service/rest/v1/blobstores) with the obtained credentials to list existing blobstores and identify targets for conversion.
4. Invoke vulnerable endpoint: Send a crafted API request to one of the two vulnerable blobstore group management REST API endpoints, supplying the target blobstore name and group configuration parameters, using only the nexus:blobstores:create permission — bypassing the intended nexus:blobstores:update authorization check.
5. Convert blobstore: The endpoint processes the request without enforcing the correct permission, converting the existing blobstore into a group blobstore and modifying its configuration without administrator approval (Github Advisory).

• Logs: Nexus Repository audit logs showing blobstore group conversion or update operations performed by accounts holding only the nexus:blobstores:create permission; unexpected REST API calls to blobstore group management endpoints from non-administrator accounts.
• Network: Unusual REST API requests (e.g., POST/PUT) to blobstore group management endpoints (/service/rest/v1/blobstores/group/...) originating from accounts not expected to perform administrative blobstore operations.
• Configuration: Unexpected changes to blobstore configurations, particularly existing blobstores that have been converted to group blobstores without a corresponding administrator change request or change management record.

Sonatype has addressed this vulnerability in Nexus Repository 3.96.0, released September 1, 2026; upgrading to version 3.96.0 or later is the recommended remediation (Sonatype Release Notes). As an interim workaround, administrators should restrict the nexus:blobstores:create permission to only fully trusted users and review all accounts currently holding this permission. Additionally, audit logs should be reviewed to identify any unauthorized blobstore conversions that may have already occurred.