CVE-2026-97712: CWE-862 Missing Authorization in Sonatype Nexus Repository 3

Sonatype Nexus Repository 3 contains a missing authorization vulnerability (CWE-862) where users granted role create or role update permissions can assign roles and privileges beyond their current permissions. This improper authorization check enables privilege escalation, allowing such users to gain full administrative access. The vulnerability affects versions from 3.0.0 up to but not including 3.97.0. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required beyond role create or update, and no user interaction needed.

Exploitation of this vulnerability allows an attacker with limited role management permissions to escalate their privileges to full administrative access within Nexus Repository 3. This can lead to unauthorized control over repository configurations, data, and potentially the software supply chain managed by the repository.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict role create and role update permissions to trusted users only to minimize risk.