CVE-2026-17594 in Nexus Repository 3
Summary
by MITRE • 08/07/2026
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical authorization flaw in Nexus Repository Manager 3 that stems from a fundamental misalignment between access control checks and actual resource creation logic. The issue manifests as an incorrect authorization condition where the system validates permissions against one field while using a different attacker-controlled field to determine the repository format that gets created. This type of vulnerability falls under CWE-863, which specifically addresses "Incorrect Authorization" where the authorization check is performed against the wrong object or attribute, leading to privilege escalation opportunities.
The technical implementation of this flaw occurs within the repository creation user interface of Nexus Repository Manager 3 CE and Pro versions ranging from 3.0.0 through 3.94.x. When a user with delegated repository-admin privileges attempts to create a repository, the system performs authorization checks against a specific field that determines what repository format they should be allowed to create. However, the actual repository format creation is determined by a separate field that can be manipulated by the attacker, allowing them to bypass the intended authorization controls and create repositories of unauthorized formats. This misconfiguration creates an attack surface where legitimate users with limited privileges can effectively escalate their capabilities beyond what their assigned permissions should allow.
The operational impact of this vulnerability extends significantly beyond simple privilege escalation, as it allows attackers to potentially create repositories that could be used for malicious purposes within the organization's software supply chain. An attacker who successfully exploits this vulnerability could create repositories with formats that are not intended for their role, potentially leading to unauthorized access to sensitive data, or creating repository configurations that could be used to host malicious artifacts. The vulnerability specifically targets users with delegated repository-admin privileges scoped to particular repository formats, meaning it affects the security model of Nexus Repository Manager's role-based access controls and could enable attackers to bypass the intended security boundaries between different repository types.
The attack vector requires an authenticated user who holds delegated repository-admin privileges for a specific repository format, making this vulnerability particularly concerning as it leverages legitimate administrative capabilities to perform unauthorized actions. The anonymous user is not affected by this issue since they cannot hold the necessary privileges by default, but any legitimate user with appropriate permissions could potentially exploit this flaw. Security practitioners should note that this vulnerability directly relates to ATT&CK technique T1078.004 which covers "Valid Accounts: Cloud Accounts" and represents a form of privilege escalation through misconfigured access controls, where the system's authorization mechanism fails to properly validate user intentions against actual resource creation behavior.
The fix implemented in version 3.95.0 addresses this vulnerability by ensuring that the authorization checks are consistently applied to the same fields used for determining repository format creation. This correction aligns the permission validation logic with the actual resource creation process, eliminating the discrepancy that allowed attackers to bypass authorization controls. Organizations using affected versions should prioritize upgrading to 3.95.0 or later immediately, as this vulnerability could enable attackers to escalate privileges within the Nexus Repository Manager environment and potentially compromise the integrity of the software supply chain. The remediation addresses the core architectural issue where field validation was not properly synchronized between authorization checks and actual repository creation logic, fundamentally strengthening the access control implementation.
This vulnerability demonstrates the critical importance of maintaining consistency in authorization mechanisms across all system components, particularly in security-critical applications like package repositories that form the backbone of modern software development workflows. The fix reinforces proper separation of concerns in access control design, ensuring that authorization decisions are consistently applied to the appropriate fields and attributes rather than allowing one field's validation to be bypassed by manipulation of a different field. Organizations should conduct thorough security reviews of their Nexus Repository Manager implementations to ensure no other similar inconsistencies exist in their access control logic.