Auth bypass in Sonatype Nexus Repository 3
CVE-2026-77122
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (19.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
Weakness classification (CWE)
References
- 103e4ec9-0a87-450b-af77-479448ddef11 (Release Notes, patch)
- 103e4ec9-0a87-450b-af77-479448ddef11 (vendor-advisory, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-77122?
- CVE-2026-77122 is a medium-severity vulnerability in Sonatype Nexus Repository 3, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2026-09-02.
- How severe is CVE-2026-77122?
- Medium severity. CVSS v3 base score is 4.3 out of 10.