Sonatype Nexus Security Advisory
Date: October 15, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.96.4
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.97.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 8.7 (High)
CWE: CWE-862: Missing Authorization
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-97712
Summary
A vulnerability in the role management functions of Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. The user can use this to give itself or other accounts more access than intended, up to full administrative access.
At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.
Recommendation
Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.97.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.
After the upgrade, a user can only add roles and privileges to a role if the user already holds them. Full administrators are not affected by this change.
If an instance had users with the role create or role update permission before the upgrade, review the roles and users on that instance for unexpected privileges. Remove any role or privilege that you did not intend to grant.
Immediate Mitigation Options
There is no configuration change that fully mitigates this vulnerability without upgrading. The following measures reduce exposure:
-
Restrict the permissions: Grant the
nx-roles-createandnx-roles-updateprivileges (or any role that contains them) only to fully trusted administrators. - Review existing roles: Check which users hold these privileges. Check the roles that those users can edit for unexpected privileges or contained roles.
- Network-level access control: Restrict access to the Nexus Repository web interface to trusted networks.
Credit
This issue was discovered and reported responsibly by Beni Saprulah (HackerOne: https://hackerone.com/bebensap, LinkedIn: https://www.linkedin.com/in/beni-saprulah) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: A user who holds the role create or role update permission can gain access beyond what the administrator intended, up to full administrative access. With administrative access, the user can read and change repositories, users, roles, and configuration on the instance.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must have network access to the Nexus Repository web interface. The attacker must hold the nx-roles-create or nx-roles-update privilege, directly or through a role. All supported configurations of Nexus Repository 3 CE/Pro from 3.0.0 are affected. Instances where only fully trusted administrators hold these privileges have no added exposure from this vulnerability.
Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.
Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We coordinate with security researchers who report vulnerabilities to us in good faith, and we publish advisories after a fix is available so that users can take informed action to protect their installations.