CVE-2026-77125

Sonatype Nexus Repository 3 contains an incorrect authorization check (CWE-863) in two blobstore group management REST API endpoints, which fail to enforce the intended permission. An authenticated user granted only the nexus:blobstores:create permission — a named permission that must be explicitly assigned by an administrator and is not held by default — can call these endpoints to convert an existing blobstore into a group blobstore, an operation that should require the nexus:blobstores:update permission. The result is unauthorized modification of the blobstore configuration (high integrity impact per the CVSS 4.0 vector) without administrator approval, with no confidentiality or availability impact. Any Nexus Repository 3 deployment in which administrators have granted nexus:blobstores:create without nexus:blobstores:update is affected, and exploitation requires valid low-privilege credentials with no user interaction. No exploitation in the wild is known, no public proof-of-concept exists, and EPSS estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Audit custom RBAC roles in Nexus Repository 3 for users or roles holding nexus:blobstores:create without nexus:blobstores:update, and either align those grants or restrict access to the blobstore group REST endpoints until patched. Upgrade to the vendor's fixed release for this CVE as soon as it is available (no fixed version number was included in the available data), and review audit logs for unexpected conversions of existing blobstores into group blobstores.