Sonatype Nexus Security Advisory
Date: October 15, 2026
Affected Versions: Nexus Repository 3 CE/Pro versions 3.95.0 through 3.96.x
Fixed in Version: Nexus Repository 3 CE/Pro version 3.97.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N = 7.1 (High)
CWE: CWE-862: Missing Authorization
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-97665
Summary
Nexus Repository 3 versions 3.95.0 through 3.96.x contain a missing authorization check in the Components API upload path for NuGet symbol packages. An account holding only repository read and browse privileges for a NuGet hosted repository with Symbol Server enabled can upload and persist a symbol package (.snupkg) to that repository, bypassing the write-permission check that is normally enforced for package uploads. This allows a low-privileged account to write unauthorized content into a repository it was only granted read access to. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without any authenticated account.
Recommendation
Upgrade to Nexus Repository 3 version 3.97.0 or later. Download the latest version at https://help.sonatype.com/en/download.html.
Immediate Mitigation Options
If immediate upgrade is not possible, disable the NuGet Symbol Server feature on any hosted NuGet repository, or restrict read/browse role assignment on NuGet hosted repositories to fully trusted accounts until the upgrade is applied.
Credit
This issue was discovered and reported responsibly by wupco123 via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker with a low-privileged account (read/browse only) on a NuGet hosted repository can upload and persist symbol packages into that repository without holding write/edit permission, allowing unauthorized modification of repository contents.
Q: What preconditions must be met in order to be vulnerable?
A: The target must have a hosted NuGet repository with Symbol Server enabled, and the attacker must hold an account with at least read and browse privileges on that repository. If anonymous access is enabled, this precondition can be met without authentication, since the built-in anonymous user is granted read/browse privileges across all repositories by default.
Q: Are there implications associated with this advisory itself?
A: As with any vulnerability disclosure, publishing details could help a malicious actor exploit unpatched instances. We recommend assessing your exposure and applying the fix promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies customers of vulnerabilities and remediation steps so they can take appropriate action.