Two REST API endpoints in Sonatype Nexus Repository Manager 3 fail to enforce the required authorization check. A user granted only the nexus:blobstores:create permission can use these endpoints to convert an existing blobstore into a group blobstore, an operation that normally requires the higher nexus:blobstores:update permission. This flaw allows a low‑privilege user to alter the repository’s storage configuration without administrator approval, potentially exposing or reorganizing stored artifacts.

All Sonatype Nexus Repository 3 releases from 3.19.0 through 3.95.3 are affected.

The CVSS score of 7.1 indicates a moderate severity. EPSS is not reported, and the vulnerability is not listed in the CISA KEV catalog. The attack remains feasible because it relies on REST services that are remotely accessible to authenticated users with the create permission. An attacker can issue a simple POST request to either of the two endpoints to convert a blobstore type, a low‑effort, no‑zero‑day maneuver that can be leveraged by anyone holding an account that can create blobstores.