Sonatype Nexus Repository Manager versions prior to 3.93.0 contain an incorrect authorization vulnerability (CWE-863) in the proxy repository configuration. This flaw allows delegated repository administrators to access and disclose stored upstream proxy credentials, which should normally be protected. The vulnerability requires high privileges (delegated admin) and does not require user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, and partial privileges required.

An attacker with delegated repository administrator privileges can disclose sensitive upstream proxy credentials stored in the Nexus Repository Manager. This could lead to unauthorized access to upstream resources or further compromise depending on the credentials exposed. The impact is limited by the requirement for delegated admin privileges and does not allow direct code execution or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor Sonatype's advisories for updates. Until a patch is available, restrict delegated repository administrator privileges to trusted personnel only and review proxy repository configurations to minimize exposure.