https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T15:19:02.451952+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-17594 CVE-2026-17594 — Nexus Repository 3 - Authorization Bypass in Repository Creation 2026-10-07T15:19:02.468140+00:00

Affected: Sonatype Nexus Repository 3

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.