CVE-2026-77122: Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent unauthorized callers from accessing the Nexus Repository 3 REST API endpoint GET /service/rest/v1/repositories/{repositoryName} (e.g., restrict network access to the Nexus UI/API to trusted clients and block direct access from untrusted sources).
- Compensating control
Review and minimize read/browse permissions granted on Nexus group repositories so that accounts (including the anonymous user, if applicable) do not have group read/browse rights that would allow metadata disclosure of member repositories for which they have no direct permission.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any account with read or browse permission on a group repository may be able to request metadata for its member repositories without having direct permission on those members. Anonymous access is also affected if the installation's anonymous role has that group-repository permission.
What information could be exposed?
The repository details REST endpoint can disclose metadata for member repositories. For proxy repositories, this metadata includes the configured remote URL and may expose internal upstream hostnames.
How can administrators assess whether their installation is exposed?
Review roles and permissions assigned to users, especially the anonymous user, for read or browse access to group repositories. Identify group repositories whose members include repositories that those roles are not intended to access directly, particularly proxy repositories with internal remote URLs.