Sonatype Nexus Repository 3 is affected by a privilege escalation flaw that permits any user with the ability to create or update roles to grant additional roles and permissions beyond their own entitlement. This flaw arises from missing authorization checks in role membership assignment, allowing attackers to elevate privileges to full administrative control over the repository. The weakness is categorized as CWE‑862 (Missing Authorization) and can lead to unauthorized configuration changes, data exposure, and full access to repository management functions.

The issue impacts all Sonatype Nexus Repository 3 releases from 3.0.0 through 3.96.4, inclusive. Any deployment of Nexus Repository 3 within that version range that contains users with role creation or update permissions is potentially vulnerable. The risk applies to both on‑premises and cloud‑hosted installations of Nexus Repository 3.

The vulnerability carries a CVSS score of 8.7, indicating a high severity. The EPSS score is < 1%, suggesting a low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated account that already possesses role‑management capabilities; thus, the attack vector is internal, relying on legitimate user privileges. Once exploited, the attacker can grant themselves or others any role, effectively bypassing intended access controls.