CVE-2026-77125 Sonatype CVE debrief

Who should care

Defenders responsible for Sonatype Nexus Repository 3 deployments should assess exposure and prioritize remediation, as this vulnerability could result in unauthorized modification of blobstore configuration without administrator approval.

Why it matters

Defenders should prioritize verifying and applying the vendor's remediation for this vulnerability, as it could result in unauthorized modification of blobstore configuration without administrator approval. This vulnerability affects Sonatype Nexus Repository 3 deployments, and users with the nexus:blobstores:create permission may be able to invoke endpoints to convert an existing blobstore into a group blobstore without proper authorization.

• Potential unauthorized modification of blobstore configurations
• Verification of user permissions and access controls is necessary
• Remediation priority for affected versions is high
• Further verification of exploitation or impact is required

Technical summary

The vulnerability affects Sonatype Nexus Repository 3, specifically versions between 3.19.0 and 3.96.0. It involves two blobstore group management REST API endpoints that do not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default. Defenders should be

Defensive priority

Defenders should prioritize verifying and applying the vendor's remediation for this vulnerability, as it could result in unauthorized modification of blobstore configuration without administrator approval.

Recommended defensive actions

• Verify and apply the vendor's remediation for this vulnerability
• Review and update permissions for users with the nexus:blobstores:create permission
• Monitor for any unauthorized modifications to blobstore configurations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability affects Sonatype Nexus Repository 3, specifically versions between 3.19.0 and 3.96.0. Defenders should verify and apply the vendor's remediation for this vulnerability, as it could result in unauthorized modification of blobstore configuration without administrator approval. Evidence from the CVE record and NVD entry suggests that users with the nexus:blobstores:create permission may be be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.