CVE-2026-17600 is an insufficient session expiration vulnerability (CWE-613) in Sonatype Nexus Repository 3. When a user's account is deleted, deactivated, or its password changed, the system does not immediately terminate the user's active login session or revoke cached permissions. Consequently, a user with an active session at the time of these account changes can continue interacting with the repository as if the account were still active. This persistent session can allow unauthorized read, modify, or delete operations on repository content until the session expires on its own.

The vulnerability allows continued unauthorized access to repository content by users whose accounts have been deleted, deactivated, or had their passwords changed, as their active sessions remain valid until expiration. This can lead to unauthorized data exposure, modification, or deletion, violating access control policies and potentially compromising repository integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider manually terminating active sessions when user accounts are modified or removed, if possible, and monitor for suspicious activity related to session persistence.