Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 through 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L = 8.9 (High)
CWE: CWE-862: Missing Authorization
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17601
Summary
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment. This allows privilege escalation to full administrator by a user who was granted only a narrow privilege-management permission.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
Customers who cannot upgrade immediately should review which users and roles hold the permission to create or update privilege definitions, and restrict it to fully trusted administrators only, since this permission can currently be leveraged to self-escalate to full administrator access.
Credit
This issue was discovered and reported responsibly by Beni Saprulah (HackerOne: https://hackerone.com/bebensap, LinkedIn: https://www.linkedin.com/in/beni-saprulah) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker who holds permission to create or update privilege definitions can grant themselves full administrator access to the Nexus Repository instance, without any change to their assigned role.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold a permission that allows creating or updating privilege definitions, and must already have a mutable custom wildcard privilege assigned to their role.
Q: Are there implications associated with this advisory itself?
A: Yes. Publishing details of a vulnerability can provide information that bad actors may use to compromise unpatched systems. Sonatype recommends assessing your exposure and upgrading as soon as possible.
Q: Why is Sonatype making this information available?
A: Sonatype is committed to responsible disclosure practices, providing customers with the information needed to assess risk and take appropriate action, following coordinated remediation.