CVE-2026-77125 Overview
CVE-2026-77125 is an authorization flaw in Sonatype Nexus Repository 3 affecting two blobstore group management REST API endpoints. The endpoints do not enforce the intended authorization check. A user granted only the nexus:blobstores:create permission can invoke these endpoints to convert an existing blobstore into a group blobstore. That action should require the nexus:blobstores:update permission. The result is unauthorized modification of blobstore configuration without administrator approval. The issue is classified as Broken Access Control [CWE-863].
Critical Impact
Low-privileged users holding only nexus:blobstores:create can alter blobstore configuration and convert existing blobstores into group blobstores, bypassing the administrator-controlled update permission.
Affected Products
- Sonatype Nexus Repository 3 (versions prior to 3.96.0)
- Blobstore group management REST API endpoints
- Deployments where the nexus:blobstores:create permission has been explicitly granted to non-admin users
Discovery Timeline
- 2026-09-02 - CVE-2026-77125 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77125
Vulnerability Analysis
CVE-2026-77125 is a broken authorization vulnerability in Sonatype Nexus Repository 3. Nexus Repository enforces access control through named permissions such as nexus:blobstores:create and nexus:blobstores:update. Two REST API endpoints responsible for blobstore group management check the wrong permission before executing their action. The endpoints validate the caller's create permission when the operation semantically performs an update on an existing blobstore. This mismatch allows a caller who can create blobstores to also modify existing ones by converting them into group blobstores.
Root Cause
The root cause is an incorrect authorization check on the blobstore group management endpoints [CWE-863]. The endpoints associate the wrong named permission with a state-changing operation. Converting an existing blobstore into a group blobstore modifies persistent configuration and should be gated by nexus:blobstores:update. The endpoints instead accept nexus:blobstores:create, breaking the intended separation between blobstore creation and blobstore modification.
Attack Vector
Exploitation requires network access to the Nexus Repository REST API and an authenticated account holding nexus:blobstores:create. The nexus:blobstores:create permission is not held by default and must be explicitly granted by an administrator. Where it has been delegated, the holder can call the affected blobstore group management endpoints to reconfigure an existing blobstore into a group blobstore. This affects integrity of the repository configuration but does not disclose data or affect availability directly. See the Sonatype Support Article for vendor technical details.
Detection Methods for CVE-2026-77125
Indicators of Compromise
- Unexpected blobstore configuration changes converting standard blobstores into group blobstores without a corresponding administrator action.
- REST API calls to the blobstore group management endpoints originating from user accounts that do not hold nexus:blobstores:update.
- Audit log entries showing blobstore modifications performed by accounts with only the nexus:blobstores:create permission.
Detection Strategies
- Review Nexus Repository audit logs for blobstore configuration changes and correlate the acting user's permission set against the operation performed.
- Enumerate accounts and roles that hold nexus:blobstores:create and inspect their recent API activity for calls targeting group blobstore endpoints.
- Compare current blobstore inventory against a known-good configuration baseline and flag newly created group blobstores.
Monitoring Recommendations
- Forward Nexus Repository access and audit logs to a centralized logging or SIEM platform for retention and correlation.
- Alert on REST API activity against blobstore group management endpoints, particularly from non-administrator identities.
- Track role and permission grant changes for nexus:blobstores:create to detect scope expansion.
How to Mitigate CVE-2026-77125
Immediate Actions Required
- Upgrade Sonatype Nexus Repository 3 to a fixed release. See the Sonatype Release Notes - Nexus 3.96.0 for the corrected authorization behavior.
- Audit every role and user assignment carrying the nexus:blobstores:create permission and revoke it where it is not operationally required.
- Review recent blobstore configuration changes and roll back any unauthorized conversions to group blobstores.
Patch Information
Sonatype addressed the authorization check on the affected blobstore group management REST API endpoints in Nexus Repository 3.96.0. Details are documented in the Sonatype Release Notes - Nexus 3.96.0 and the Sonatype Support Article. Administrators should apply the update following Sonatype's documented upgrade procedure.
Workarounds
- Restrict the nexus:blobstores:create permission to administrative accounts only until the upgrade is applied.
- Limit network access to the Nexus Repository REST API to trusted management networks and CI/CD systems.
- Increase audit log review cadence for blobstore-related operations while the mitigation is in place.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
