Sonatype Nexus Repository 3 fails to verify that a user account has permission to read a repository before adding that repository as a member of a group repository. When a user with add or edit privileges on a group repository adds an otherwise unreadable repository, the user can read the repository’s content through the group. This flaw allows a legitimate authenticated user to bypass normal read permissions on selected repositories and can also expose repository data to anonymous users if the administrator has granted add or edit rights to anonymous access. The vulnerability is a CWE‑862 (Missing Authorization Check).

Sonatype Nexus Repository 3 – all released versions from 3.0.0 through 3.97.1 are affected. The flaw exists in the Nexus Repository Manager component that manages group repositories. Existing installations of any of the listed CPE strings for Sonatype Nexus Repository Manager version ranges are potentially vulnerable until the fix is applied.

The CVSS score of 5.3 indicates a moderate severity. EPSS was not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting it is not a known exploited threat yet. However, the flaw requires only the add or edit permission on a group repository, which administrators often grant to developers or CI/CD services. An attacker who can log in with such permissions can add a target repository to a group and read its contents, potentially leaking confidential artifacts. Because it is a privilege escalation and data disclosure flaw, the impact could be high if sensitive data is stored in the repository. The vulnerability is exploitable by authenticated users; an anonymous attacker would need an administrator to grant add/edit privileges to anonymous access, which is uncommon but possible. Overall, the risk remains moderate to high based on the prevalent exposure of group-modifying privileges.