CVE-2026-17600 describes a session management flaw in Sonatype Nexus Repository 3. When a user's account is deleted, deactivated, or its password changed, the system does not immediately terminate the user's active login session or revoke cached permissions. Consequently, the user can continue interacting with the repository as if their account were still active until the session naturally expires. This behavior violates intended access controls and can result in unauthorized repository access based on the user's prior permissions.

The vulnerability allows continued unauthorized access to repository content after a user's account status changes to deleted, deactivated, or password changed. Depending on the permissions held by the user at the time of the session, this could enable reading, modifying, or deleting repository data despite the intended revocation of access. This undermines access control enforcement and increases risk of data compromise or unauthorized changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider manually terminating active sessions when user accounts are changed or removed, if possible, and closely monitor user activity. Follow any vendor recommendations once published.