CVE-2026-77122
Received Received - Intake

Authorization Bypass in Sonatype Nexus Repository REST API

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Sonatype

Description
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-77122
EUVD
EUVD-2026-70231

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sonatype nexus_repository 3
sonatype nexus_repository to 3.96.0 (exc)
sonatype nexus_repository 3.96.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in Sonatype Nexus Repository 3's REST API. It allows users with read or browse permissions on a group repository to access metadata of member repositories they don't have direct permissions for by directly querying the repository details endpoint. For proxy repositories, this exposes the remote URL, potentially revealing internal hostnames.

Detection Guidance

To detect this vulnerability, check Nexus Repository logs for unauthorized access attempts to the REST API endpoint GET /service/rest/v1/repositories/{repositoryName}. Look for requests querying member repository names where the user lacks direct permissions. Verify if proxy repository metadata, including remote URLs, is exposed to unauthorized users.

Impact Analysis

An attacker with limited permissions could exploit this to gather sensitive information about internal systems, such as upstream hostnames used by proxy repositories. This could aid further attacks by mapping internal network structures.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing internal upstream hostnames through proxy repository metadata. Unauthorized access to such details could violate data protection requirements under GDPR (e.g., unauthorized data disclosure) or HIPAA (e.g., exposing internal system configurations). Organizations must ensure proper role-based access controls are enforced to mitigate unauthorized metadata access.

Mitigation Strategies

Immediately upgrade to Nexus Repository 3 version 3.96.0 or later. If upgrading is not possible, audit and restrict group-repository read/browse permissions to prevent unauthorized access to member repository metadata. Remove permissions for accounts like the anonymous user if they have unnecessary access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart