Session Management Flaw in Sonatype Nexus Repository by Sonatype

CVE-2026-17600

What is CVE-2026-17600?

In Sonatype Nexus Repository, a vulnerability exists that allows a user to maintain their active login session even after their account has been deleted, deactivated, or had their password changed. This flaw enables a logged-in user to continue operating under the assumption that their account is still active, which poses a serious security risk. Users whose accounts have been altered can still exploit their existing session to read, modify, or delete repository content that should be inaccessible. Immediate session termination is essential to prevent unauthorized access following account changes.

References