Skip to main content

Security updates: eMudhra certificate incident and PHP2Shell: Sonatype is aware of the eMudhra certificate incident and the PHP2Shell vulnerabilities. We are updating our products to address the eMudhra issue and have confirmed that Sonatype products are not impacted by PHP2Shell. Read Sonatype's assessment and guidance

CVE-2026-113368 Nexus Repository 3 - Group Repository Member Authorization Bypass - 2026-11-04

Updated

Sonatype Nexus Security Advisory

Date: November 4, 2026

Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to, but not including, 3.98.0

Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.98.0

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N = 5.3 (Medium)

CWE: CWE-862: Missing Authorization

Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-113368

Summary

A vulnerability in Sonatype Nexus Repository 3 allows a user who can create or edit a group repository to add a repository as a group member without having read or browse access to that repository. The user can then read the content of that repository through the group.

The user must have signed in with valid credentials and must hold the add or edit privilege on a group repository. The anonymous user (a user that has not signed in) can only use this vulnerability if an administrator has explicitly granted the anonymous user that privilege. It is not granted by default.

At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.

Recommendation

Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.

The fix checks new group members only. It does not change group repositories that already exist. After you upgrade, review your existing group repositories. Remove each member repository that the users who can edit the group are not allowed to read.

Immediate Mitigation Options

There is no configuration change that fully mitigates this vulnerability without upgrading. The following measures reduce exposure:

  • Restrict the privileges: Grant the group repository add and edit privileges (nx-repository-admin-<format>-<repository>-add and nx-repository-admin-<format>-<repository>-edit, or any role that contains them) only to fully trusted users. Do not grant them to the anonymous user.
  • Review existing groups: Check each group repository for member repositories that are more restricted than the group. Remove members that are not intended to be visible to the users of the group.

Credit

This issue was discovered and reported responsibly by Beni Saprulah (HackerOne: https://hackerone.com/bebensap, LinkedIn: https://www.linkedin.com/in/beni-saprulah) via Sonatype’s Bug Bounty Program.

Frequently Asked Questions

Q: What is the risk associated with this vulnerability?
A: A user can read content of a repository that the user is not allowed to access directly. This content can include private packages, release files, and cached content from proxy repositories. The user can only add repositories that have the same format as the group.

Q: What preconditions must be met in order to be vulnerable?
A: The attacker must have network access to the Nexus Repository web interface or REST API. The attacker must use an account that has signed in with valid credentials. The account must hold the add privilege (to create a group) or the edit privilege (to change a group) on a group repository, directly or through a role. The anonymous user can only meet this precondition if an administrator has explicitly granted it one of these privileges. The restricted repository must have the same format as the group.

Q: Does the upgrade remove members that were added before the fix?
A: No. The fix checks members that are added after the upgrade. Group members that were already stored are kept, so that existing group configurations continue to work. Review your existing groups as described in the Recommendation section.

Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.

Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We coordinate with security researchers who report vulnerabilities to us in good faith, and we publish advisories after a fix is available so that users can take informed action to protect their installations.

Related articles