CVE-2026-77125: CWE-863 Incorrect Authorization in Sonatype Nexus Repository 3

This vulnerability in Sonatype Nexus Repository 3 involves improper authorization checks on two REST API endpoints related to blobstore group management. Users granted only the nexus:blobstores:create permission can convert an existing blobstore into a group blobstore, an operation that should require the nexus:blobstores:update permission. This incorrect authorization enforcement could allow unauthorized configuration changes to blobstores, potentially impacting repository integrity or management. The affected version explicitly identified is 3.19.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with the nexus:blobstores:create permission, which is not granted by default and requires explicit administrator assignment, can modify blobstore configurations without proper authorization. This could lead to unauthorized changes in repository storage management, potentially affecting repository stability or security. The vulnerability does not allow privilege escalation beyond the assigned permission but misuses an existing permission to perform unauthorized actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully review and restrict assignment of the nexus:blobstores:create permission to trusted users only, as this permission enables unauthorized blobstore configuration changes due to the vulnerability.