---
id: CVE-2026-97712
title: >-
  Sonatype Nexus Repository 3 allows a user that holds the role create or role
  update permission to grant roles and privileges that the account does not hold
summary: >-
  Sonatype Nexus Repository 3 allows a user that holds the role create or role
  update permission to grant roles and privileges that the account does not
  hold. This can give the user more access than intended, up to full
  administrative access.
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-862
vendor: Sonatype
product: Nexus Repository 3
affected:
  - nexus_repository_3 >= 3.0.0 < 3.97.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T17:17:34.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97712'
references:
  - url: >-
      https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html
    label: 103e4ec9-0a87-450b-af77-479448ddef11
  - url: 'https://support.sonatype.com/hc/en-us/articles/56207076233619/'
    label: 103e4ec9-0a87-450b-af77-479448ddef11
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T16:09:57.653622Z'
cvssSource: cna
ingestedAt: '2026-10-15T16:13:11.149Z'
---

## Overview

Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.