CVE-2026-77125 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints

High 7.1 Published 2 Sep 2026 Updated 2 Sep 2026

Users with create permissions can improperly modify blobstore configurations due to missing authorization checks on specific REST API endpoints.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-77125?

CVE-2026-77125 is a high-severity missing authorization vulnerability in Sonatype Nexus Repository Manager, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.

Weakness: CWE-863

Which versions are affected by CVE-2026-77125?

It affects 1 product.

Products include Sonatype Nexus Repository Manager.

How do I fix CVE-2026-77125?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-77125 being exploited?

There is no known exploitation of CVE-2026-77125 in the wild and no public exploit code.

All Sonatype Nexus Repository Manager vulnerabilities

Sources

Also known as GHSA-mgww-mhp8-f89c, MINI-qfgx-w65c-4m44, MINI-rxrg-gwm4-3x95.