Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does…
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Sonatype / JFrog
- Product
- Java libraries / app servers, Nexus Repository / Artifactory
- Exposure class
- Web platform, Developer platform
Why it ranks 5 (Routine)
- Product class: web platform, developer platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-97712 on this site · NVD · CVE.org · Vulnpedia