VulnSocial

CVE-2026-17594Disclosure(sonatype / nexus_repository_manager)

LOWCVSS 4.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

sonatype CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • nexus_repository_manager

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
sonatype
Products
nexus_repository_manager

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-19: 1Technical Details · 2026-08-19: 108-19
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-17594 - high 🚨 Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch > Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vu... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-17594 @pdnucle...

    Post summary

    The tweet announces CVE‑2026‑17594, a privilege escalation flaw in Sonatype Nexus Repository versions 3.0.0 to 3.94.x, but provides no PoC, exploit, or active exploitation details.

    00011256
    1.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsonatypenexus_repository_manager---

Explore more

Back to dashboardsonatype CVEsnexus_repository_manager vulnerabilities