---
id: CVE-2026-17600
title: >-
  Sonatype Nexus Repository 3 did not immediately terminate a user's active
  login session or revoke their cached permissions when that user's account was
  deleted, deactivated, or had its password changed
summary: >-
  Sonatype Nexus Repository 3 did not immediately terminate a user's active
  login session or revoke their cached permissions when that user's account was
  deleted, deactivated, or had its password changed. A user whose account was
  already l…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-613
vendor: sonatype
product: nexus_repository_manager
affected:
  - 'nexus_repository_manager >= 3.0.0, < 3.95.0'
patched:
  - nexus_repository_manager 3.95.0
published: '2026-08-07'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:47:39.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-17600'
references:
  - url: >-
      https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
    label: 103e4ec9-0a87-450b-af77-479448ddef11
  - url: 'https://support.sonatype.com/hc/en-us/articles/53888843674003/'
    label: 103e4ec9-0a87-450b-af77-479448ddef11
tags:
  - nvd
epss: 0.00246
epssPercentile: 0.14049
ingestedAt: '2026-09-22T17:07:07.351Z'
---

## Overview

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

## Affected

- `nexus_repository_manager >= 3.0.0, < 3.95.0`

## Remediation

Upgrade past the affected range:

- `nexus_repository_manager 3.95.0`