CVE-2026-97712

UNKNOWN 0.0

Nexus Repository 3 - Privilege Escalation via Role Management

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.

CWE	CWE-862
Vendor	sonatype
Product	nexus repository 3
Published	Oct 15, 2026
Last Updated	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for sonatype nexus repository 3

Be the first to know when new unknown vulnerabilities affecting sonatype nexus repository 3 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Sonatype / Nexus Repository 3

3.0.0 < 3.97.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

help.sonatype.com: https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html support.sonatype.com: https://support.sonatype.com/hc/en-us/articles/56207076233619/

Credits

Beni Saprulah (HackerOne: https://hackerone.com/bebensap, LinkedIn: https://www.linkedin.com/in/beni-saprulah)