CVE-2026-17601

Katalog CVE

CVSS 7.2 · High EPSS 0,29%

Kerentanan Missing Authorization pada sonatype nexus repository manager. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.

Rincian

Terbit di NVD

7 Agustus 2026

Terakhir diubah

23 September 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sonatype.com/hc/en-us/articles/53889365883539/ advisory vendor
• https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html release notes