Sonatype Nexus Security Advisory
Date: September 2, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 up to and including 3.95.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.96.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N = 7.1 (High)
CWE: CWE-863: Incorrect Authorization
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-77125
Summary
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval.
Sonatype is not aware of any active exploitation of this vulnerability at the time of this announcement.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.96.0 or later, available at https://help.sonatype.com/en/download.html.
Immediate Mitigation Options
If you are unable to upgrade immediately, review which users and roles hold the nexus:blobstores:create permission and restrict it to trusted administrators only, until the upgrade can be applied. Auditing custom roles is particularly important, as this permission may be granted independently of nexus:blobstores:read or nexus:blobstores:update.
Credit
This issue was discovered and reported responsibly by Mayur Udiniya aka “roughwire” https://x.com/roughwire/ via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: A user who holds only the nexus:blobstores:create permission can convert an existing blobstore into a group blobstore without holding the nexus:blobstores:update permission that this action should require. Since repositories reference blobstores by name, this can alter the storage behavior of repositories backed by the targeted blobstore, without approval from an administrator who holds the correct permission.
Q: What preconditions must be met in order to be vulnerable?
A: An attacker must hold the nexus:blobstores:create permission, which is a named, delegated permission that must be explicitly granted by an administrator - it is not held by default. No other special configuration or network position is required.
Q: Are there implications associated with this advisory itself?
A: As with any public vulnerability disclosure, publishing details about this issue could help a malicious actor identify and exploit unpatched instances. We encourage all users to assess their exposure and apply the fixed version or the mitigation described above as soon as possible.
Q: Why is Sonatype making this information available?
A: Sonatype is committed to responsible disclosure. We proactively notify and work with the reporting researcher, and we publish advisories so that our users can understand their exposure and take appropriate action.