This vulnerability (CWE-862) in Nexus Repository 3's component upload API allows an authorization bypass. Specifically, users granted only read or browse access to certain hosted repositories (Swift, Terraform, Conda) can upload artifacts despite lacking write permissions. This flaw undermines the access control model, permitting unauthorized artifact uploads. The CVSS 4.0 base score is 8.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

An attacker with read or browse privileges on affected repository types can upload arbitrary artifacts, bypassing intended write restrictions. This can lead to unauthorized modification or injection of components into repositories, potentially compromising software supply chains or development workflows. The integrity of repository contents is at high risk, while confidentiality and availability are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is documented, users should monitor Sonatype's advisories for updates. Until a fix is available, restrict read/browse access to trusted users only on Swift, Terraform, and Conda hosted repositories to minimize risk.