This vulnerability (CWE-862) in Nexus Repository 3's component upload API permits an authorization bypass where users granted only read/browse privileges on Swift, Terraform, or Conda hosted repositories can upload artifacts. This occurs because the API fails to enforce proper write-permission checks, allowing unauthorized artifact uploads. The CVSS 4.0 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, and no privileges required. The vulnerability was published on 2026-07-14 and affects exactly version 3.88.0. No patch or remediation level has been provided by the vendor as of the publication date.

An attacker with read or browse access to affected repository types can upload arbitrary artifacts, potentially leading to repository contamination or supply chain risks. This bypasses intended access controls, undermining repository integrity and trust. There are no known exploits in the wild at the time of publication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Sonatype's advisories for updates. Until a fix is available, restrict read/browse access to trusted users only on affected repository types to reduce risk.