CVE-2026-97712: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-97712 is a privilege escalation vulnerability in Sonatype Nexus Repository 3 that allows an authenticated user holding the "role create" or "role update" permission to grant roles and privileges that their account does not itself possess, potentially escalating to full administrative access. It affects all versions of Nexus Repository 3 from 3.0.0 up to (but not including) 3.97.0. The vulnerability was published on October 15, 2026, with a patch available in version 3.97.0. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-862 (Missing Authorization): the application fails to verify whether the requesting user actually holds the roles or privileges they are attempting to assign when creating or updating roles. This means the authorization check for role assignment operations does not enforce a "you can only grant what you have" constraint. An attacker with low-level authenticated access and either the "role create" or "role update" permission can craft API or UI requests to assign any role — including administrative roles — to their own account or others, without possessing those roles themselves. No special conditions, user interaction, or complex attack prerequisites are required beyond having a valid account with the noted permissions (GitHub Advisory, Feedly).

Successful exploitation allows an authenticated low-privileged user to escalate their privileges up to full administrative access within Sonatype Nexus Repository 3. With administrative access, an attacker could manipulate repository configurations, inject malicious components into hosted repositories (potentially poisoning software supply chains), exfiltrate sensitive artifacts or credentials, and disrupt repository availability. The confidentiality, integrity, and availability of the vulnerable system are all rated as High impact (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated account with role create or role update permissions, which limits the attack surface compared to unauthenticated vulnerabilities, though the impact upon exploitation is severe.

1. Reconnaissance: Identify a Sonatype Nexus Repository 3 instance running a version between 3.0.0 and 3.96.x. Confirm the instance is accessible over the network.
2. Obtain low-privileged credentials: Acquire or register an account that has been granted the "role create" or "role update" permission — this may be a developer, CI/CD service account, or any user with role management duties.
3. Access role management API or UI: Authenticate to the Nexus Repository instance and navigate to the Security > Roles management section (UI) or use the Security Management REST API endpoint (e.g., POST /service/rest/v1/security/roles or PUT /service/rest/v1/security/roles/{id}).
4. Craft a privilege escalation payload: When creating or updating a role, include administrative privileges or roles (e.g., nx-admin) in the role definition that the current account does not hold. The application fails to validate that the requesting user possesses the privileges being assigned.
5. Assign the escalated role to the attacker's account: Update the attacker's own user account (or a target account) to include the newly created or modified role with administrative privileges.
6. Achieve full administrative access: Log in or refresh the session to confirm the escalated privileges, then perform administrative actions such as managing repositories, accessing all artifacts, modifying security settings, or injecting malicious components (GitHub Advisory, Feedly).

• Logs: Audit log entries showing a low-privileged user account creating or modifying roles that include privileges (e.g., nx-admin) not previously associated with that user; role assignment events in the Nexus audit log where the actor's existing role set does not include the privileges being granted.
• Logs: Unexpected administrative actions (repository creation/deletion, user management, security configuration changes) performed by accounts not previously holding admin roles.
• Network: Unusual API calls to /service/rest/v1/security/roles (POST or PUT) from accounts that are not designated administrators, especially if followed by subsequent admin-level API activity from the same account.
• File System / Configuration: New or modified role definitions in the Nexus configuration that include nx-admin or broad wildcard privileges assigned to non-administrative users.

Sonatype has addressed this vulnerability in Nexus Repository 3.97.0, released October 14, 2026; upgrading to this version is the primary recommended remediation (Sonatype Release Notes, GitHub Advisory). As an interim workaround for organizations unable to upgrade immediately, restrict the "role create" and "role update" permissions to only trusted administrative personnel, and audit all existing role assignments to identify and revoke any unauthorized privilege escalations. Review and tighten access controls for role management functions across all Nexus Repository 3 instances running versions 3.0.0 through 3.96.x.