CVE-2026-97665: CWE-862 Missing Authorization in Sonatype Nexus Repository 3

This vulnerability (CVE-2026-97665) in Nexus Repository 3 arises from a missing authorization check in the NuGet Components API upload path. Specifically, accounts with only repository read and browse privileges can upload and persist NuGet symbol packages (.snupkg) to hosted repositories, circumventing the write-permission check that applies to ordinary package uploads. The vulnerability requires that the targeted repository is a hosted NuGet repository with Symbol Server enabled. Additionally, if anonymous access is enabled, the built-in anonymous user, which by default has read and browse privileges, can exploit this without needing an authenticated account. The CVSS 4.0 base score is 7.1, indicating high severity. No known exploits in the wild have been reported. The affected versions are >=3.95.0 and <3.97.0.

An attacker with only read and browse privileges can upload arbitrary NuGet symbol packages to a hosted repository, potentially leading to unauthorized code or artifact injection. This bypasses intended write-permission controls, increasing the risk of repository contamination or supply chain compromise. If anonymous access is enabled, unauthenticated attackers can exploit this vulnerability, broadening the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling anonymous access or the Symbol Server feature on hosted NuGet repositories to reduce exposure. Monitoring and restricting repository permissions to trusted users may also help mitigate risk.