CVE-2026-97665
Received Received - Intake

Missing Authorization Check in Nexus Repository 3 Allows NuGet Symbol Package Upload

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Sonatype

Description
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-97665
EUVD
EUVD-2026-102152

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sonatype Nexus Repository 3 3.95.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization check in Nexus Repository 3's NuGet Components API upload path. It allows an account with only read and browse privileges to upload NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user can exploit this without authentication.

Detection Guidance

Check Nexus Repository 3 versions 3.95.0 through 3.96.x for the vulnerability. Verify if NuGet Symbol Server is enabled on hosted NuGet repositories. Inspect logs for unauthorized .snupkg uploads by low-privileged accounts or anonymous users.

Impact Analysis

A low-privileged user can upload unauthorized content to a repository they only have read access to. This could lead to repository contamination, distribution of malicious packages, or unauthorized data persistence. The impact is higher if anonymous access is enabled, as anyone can exploit it without authentication.

Mitigation Strategies

Upgrade to Nexus Repository 3 version 3.97.0 or later. Alternatively, disable the NuGet Symbol Server feature on hosted NuGet repositories or restrict read/browse role assignments to trusted accounts only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97665. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart