CVE-2026-113368
Medium
Description
Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege on a group repository can add a repository that the account cannot read or browse, and then read the content of that repository through the group. The anonymous user can only do this if an administrator has explicitly granted it that privilege.
SeverityMedium
CVSS5.3
Exploit probability—
ProductSonatype Nexus Repository Manager
PublishedNov 4, 2026
First seenNov 4, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- sonatype nexus_repository_manager3.98.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sonatype nexus_repository_manager | 3.0.0 ≤ v < 3.98.0 | 3.98.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.