CVE-2026-77125: Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this authorization issue?
A user must have been explicitly granted the nexus:blobstores:create permission. That permission is not assigned by default, so users without it are not exposed to this privilege boundary failure.
What level of access does exploitation provide?
An affected user can invoke the vulnerable blobstore group management endpoints to convert an existing blobstore into a group blobstore. This enables unauthorized modification of blobstore configuration, despite lacking the intended nexus:blobstores:update permission.