Vulnerability Intelligence Report
Nexus Repository 3 - Privilege Escalation via Role Management
CVE-2026-97712
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-862 ↗CWE-862 Missing Authorization
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Sonatype | Nexus Repository 3 | 3.0.0 < 3.97.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Sonatype Inc. · Vendor · USA |
| Reserved | 2026-09-24T21:53:06 |
| Published | 2026-10-15T15:34:40 |
| Last Updated | 2026-10-16T03:56:56 |
Community Chatter & Buzz