Sonatype Nexus Repository Manager versions prior to 3.93.0 contain an incorrect authorization vulnerability (CWE-863) in the proxy repository configuration. This flaw permits a delegated repository administrator to access and disclose stored upstream proxy credentials, potentially exposing sensitive authentication information. The vulnerability is identified as CVE-2026-10741 and carries a CVSS 4.0 base score of 5.9, indicating a medium severity impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with delegated repository administrator privileges can disclose stored upstream proxy credentials due to improper authorization controls. This could lead to unauthorized access to upstream resources that rely on these credentials, potentially compromising confidentiality of sensitive authentication data. The vulnerability does not allow privilege escalation or remote code execution but exposes sensitive credentials within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict delegated repository administrator privileges to trusted personnel only and monitor access to proxy repository configurations to minimize risk.