Sonatype Nexus Repository up to 3.95.x Script Execution /service/rest/v1/script Name permission

Summaryinfo

A vulnerability categorized as critical has been discovered in Sonatype Nexus Repository up to 3.95.x. Affected by this vulnerability is an unknown functionality of the file /service/rest/v1/script of the component Script Execution. Executing a manipulation of the argument Name can lead to permission. This vulnerability is handled as CVE-2026-77124. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Sonatype Nexus Repository up to 3.95.x. It has been declared as critical. This vulnerability affects an unknown functionality of the file /service/rest/v1/script of the component Script Execution. The manipulation of the argument name with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

The advisory is available at help.sonatype.com. This vulnerability was named CVE-2026-77124 since 08/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

Upgrading to version 3.96.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Sonatype

Name

• Nexus Repository

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.39
• 3.40
• 3.41
• 3.42
• 3.43
• 3.44
• 3.45
• 3.46
• 3.47
• 3.48
• 3.49
• 3.50
• 3.51
• 3.52
• 3.53
• 3.54
• 3.55
• 3.56
• 3.57
• 3.58
• 3.59
• 3.60
• 3.61
• 3.62
• 3.63
• 3.64
• 3.65
• 3.66
• 3.67
• 3.68
• 3.69
• 3.70
• 3.71
• 3.72
• 3.73
• 3.74
• 3.75
• 3.76
• 3.77
• 3.78
• 3.79
• 3.80
• 3.81
• 3.82
• 3.83
• 3.84
• 3.85
• 3.86
• 3.87
• 3.88
• 3.89
• 3.90
• 3.91
• 3.92
• 3.93
• 3.94
• 3.95

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion