Incorrect authorization in Nexus Repository Manager - CVE-2026-77125
Published: September 7, 2026
Vulnerability identifier: #VU147239
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77125
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify blobstore configuration without authorization.
The vulnerability exists due to incorrect authorization in blobstore group management REST API endpoints when handling requests to convert an existing blobstore into a group blobstore. A remote user can invoke the endpoints with only the nexus:blobstores:create permission to modify blobstore configuration without authorization.
Affected software
Nexus Repository Manager
How to mitigate CVE-2026-77125
Install security update from vendor's website.
Nexus Repository Manager - update to 3.96.0-09