CVE-2026-113368
Received Received - Intake

Unauthorized Repository Access in Sonatype Nexus Repository 3

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Sonatype

Description
Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege on a group repository can add a repository that the account cannot read or browse, and then read the content of that repository through the group. The anonymous user can only do this if an administrator has explicitly granted it that privilege.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-113368
EUVD
EUVD-2026-117063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sonatype Nexus Repository 3 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Sonatype Nexus Repository 3 allows a user with add or edit privileges on a group repository to add another repository as a group member without having read or browse access to it. The user can then access the restricted repository's content through the group. The issue arises because Nexus does not verify repository authorization before adding it to a group.

Detection Guidance

Check Nexus Repository group memberships for unauthorized repositories. Review user privileges and group configurations. Look for repositories added to groups without proper access rights. Use Nexus Repository admin UI or API to audit group memberships and user permissions.

Impact Analysis

An attacker with valid credentials and the right privileges could access sensitive data in repositories they are not authorized to view. This could lead to data breaches, unauthorized access to intellectual property, or exposure of confidential information. The impact depends on the repositories' contents and the attacker's intent.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using Nexus Repository 3 may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade to Nexus Repository 3 CE/Pro version 3.98.0 or later. Restrict add/edit privileges on group repositories to trusted users only. Review and manually adjust existing group repository configurations to remove unauthorized members.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...