CVE-2026-97712

CVSS 8.7 (high) · published 2026-10-15

Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.

Weakness: CWE-862

Source: NVD CVE-2026-97712

References

• https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html
• https://support.sonatype.com/hc/en-us/articles/56207076233619/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.