A missing authorization check in Nexus Repository 3’s NuGet Components API upload path lets an account with only read and browse rights upload and persist NuGet symbol packages (.snupkg) to a hosted repository, sidestepping the write‑permission restriction that normally applies to regular package uploads. The vulnerability enables policy bypass and potential supply‑chain manipulation by adding unexpected metadata or malicious symbols to the repository. The attack does not grant arbitrary code execution but can alter repository contents and affect downstream consumers. The likely attack vector is an authenticated HTTP request directed at the repository’s symbol server endpoint, which is enabled only on hosted NuGet repositories. If anonymous access is turned on, the built‑in anonymous user already has read and browse rights on all repositories, so an attacker can exploit the flaw without authentication. A CVSS score of 7.1 indicates a high‑severity vulnerability, but an EPSS score of less than 1% and the absence of inclusion in the CISA KEV catalog suggest that exploitation is currently rare and not actively exploited in the wild. Nevertheless, the impact could be substantial if the attacker can modify vulnerable packages or inject malicious symbols that downstream applications might consume.

The vulnerability is present in Sonatype Nexus Repository 3 across versions 3.95.0 to 3.96.3. All releases before 3.97.0 are affected; the fix is available starting in 3.97.0.

The CVSS score of 7.1 indicates a high‑severity vulnerability that allows an attacker to modify repository content. Despite a low EPSS score of < 1% and absence in the CISA KEV catalog, the vulnerability can still be exploited when an authenticated user with read and browse access or an anonymous user with read/browse rights is able to target a hosted NuGet repository that has the Symbol Server feature enabled. Because patching to 3.97.0 or later removes the vulnerable upload path, remediation is strongly recommended.