CVE-2026-77122: CWE-863 Incorrect Authorization in Sonatype Nexus Repository 3

This vulnerability involves an incorrect authorization check in the REST API endpoint GET /service/rest/v1/repositories/{repositoryName} in Sonatype Nexus Repository 3. Users with read or browse permission on a group repository can retrieve metadata for member repositories they do not have explicit access to by directly querying the endpoint with the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, potentially revealing internal upstream hostnames. The flaw may also impact anonymous users if they have been granted read or browse permissions on group repositories.

An attacker or unauthorized user with read or browse permission on a group repository can access metadata of member repositories without proper authorization. This may lead to unintended disclosure of internal repository information, including remote URLs for proxy repositories, which could reveal internal infrastructure details. The exposure of such metadata can aid in reconnaissance but does not directly allow modification or deletion of repository content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict read or browse permissions on group repositories, especially for anonymous users, to limit exposure. Avoid granting these permissions broadly and audit role configurations to ensure minimal necessary access.