CVE-2026-97712 Sonatype CVE debrief

Who should care

Defenders and administrators responsible for Sonatype Nexus Repository 3 systems should assess exposure and verify user role permissions and access controls.

Why it matters

Defenders should care about CVE-2026-97712 because it allows users to grant excessive access in Sonatype Nexus Repository 3, potentially leading to full administrative access. This vulnerability requires verification of user role permissions and access controls, and defenders should prioritize restricting role granting permissions to trusted administrators.

• Potential for privilege escalation and increased access
• Risk of unauthorized administrative access
• Need for verification of user role permissions and access controls
• Importance of restricting role granting permissions to trusted administrators

Technical summary

The vulnerability in Sonatype Nexus Repository 3 allows users with 'create' or 'update' role permissions to grant roles and privileges beyond their own, potentially leading to full administrative access. The issue has a CVSS score of 8.7 and is considered high severity.

Defensive priority

Defenders should prioritize verifying user role permissions and access controls, reviewing current user roles and privileges, and restricting role granting permissions to trusted administrators.

Recommended defensive actions

• Verify user role permissions and access controls
• Review current user roles and privileges
• Restrict role granting permissions to trusted administrators
• Monitor for suspicious role changes or privilege escalations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected product information. However, specific details about affected versions and remediation steps are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.