Incorrect authorization in Nexus Repository Manager - CVE-2026-77122
Published: September 7, 2026
Vulnerability identifier: #VU147241
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77122
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose member repository metadata.
The vulnerability exists due to incorrect authorization in the repository details REST API endpoint when requesting details directly for a member repository. A remote user can request the endpoint for a member repository to disclose its metadata.
Exploitation requires read or browse permission on a group repository containing the target member repository and knowledge of the member repository name. For proxy repositories, disclosed metadata includes the configured remote URL.
Affected software
Nexus Repository Manager
How to mitigate CVE-2026-77122
Install security update from vendor's website.
Nexus Repository Manager - update to 3.96.0-09