# CVE-2026-77122: Sonatype Nexus Repository authorization bypass in REST API

Source: https://junglewise.ai/threats/cve-2026-77122-sonatype-nexus-repository-authorization-bypass-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77122 · Severity: medium · CVSS 4.3 · Published 2026-09-02

Sonatype Nexus Repository is a software artifact repository manager used by organizations to store and manage build dependencies and application components. A flaw in its REST API allows users with read or browse permissions on a group repository to access metadata of private member repositories they shouldn't have access to, potentially exposing internal infrastructure hostnames and upstream server URLs. The vulnerability can be exploited by unauthenticated users if the anonymous user has been granted the necessary permissions.

Technologies: [Sonatype Nexus Repository 3](https://junglewise.ai/threats/technologies/nexus-repository-3), [Sonatype Nexus Repository Manager](https://junglewise.ai/threats/technologies/nexus-repository-manager). Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-77122 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77122 being exploited in the wild.

**How severe is CVE-2026-77122?** Medium severity, with a CVSS score of 4.3, published 2 September 2026.

**Which products and versions are affected?** Sonatype Nexus Repository 3 3.0 through 3.96.2.

**Is there a fix for CVE-2026-77122?** A patch was published on 2026-09-02: Fixed in version 3.96.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77122 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77122?** Check whether you run Sonatype Nexus Repository 3 or Sonatype Nexus Repository Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authorization bypass vulnerability in the REST API endpoint GET /service/rest/v1/repositories/{repositoryName}. The vulnerable component fails to properly check permissions when responding to requests for repository details. An attacker with read or browse permissions on a group repository can query the endpoint directly for member repository names to retrieve metadata they should not access. For proxy repositories, this disclosure includes the configured remote URL, which may reveal internal upstream hostnames. The vulnerability affects Nexus Repository 3 and can be exploited unauthentically if the anonymous user holds group browse/read permissions. Patches are available in version 3.96.3 and later.

## Affected products

- Sonatype Nexus Repository 3 3.0 through 3.96.2

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 3.96.3

## References

- [https://help.sonatype.com/en/sonatype-nexus-repository-3-96-0-release-notes.html](https://help.sonatype.com/en/sonatype-nexus-repository-3-96-0-release-notes.html)
- [https://support.sonatype.com/hc/en-us/articles/54637328224019/](https://support.sonatype.com/hc/en-us/articles/54637328224019/)

## Related threats

- [Sonatype Nexus Repository 3 authorization bypass in Rut Auth capability](https://junglewise.ai/threats/cve-2026-113374-sonatype-nexus-repository-3-does-not-require-realm)
- [Sonatype Nexus Repository 3 YUM private key disclosure to read-only accounts](https://junglewise.ai/threats/cve-2026-113372-sonatype-nexus-repository-3-returns-the-private-signing-key-of-a)
- [Sonatype Nexus Repository 3 signing passphrase disclosure in REST endpoint](https://junglewise.ai/threats/cve-2026-113371-sonatype-nexus-repository-3-returns-the-signing-passphrase-of-an)
- [Sonatype Nexus Repository 3 SQL injection in Reindex Search Tables task](https://junglewise.ai/threats/cve-2026-113370-sonatype-nexus-repository-3-contains-a-sql-injection)
- [Sonatype Nexus Repository stored XSS in OCI manifest artifact type](https://junglewise.ai/threats/cve-2026-113369-sonatype-nexus-repository-3-allows-a-user-account-that-can-push)