Missing Authorization Check in Nexus Repository 3 NuGet Components

CVE-2026-97665

What is CVE-2026-97665?

A flaw in the Nexus Repository 3's NuGet Components API upload path permits users with limited repository access to upload and persist NuGet symbol packages (.snupkg) in a hosted repository. This vulnerability occurs due to the absence of a necessary authorization check, allowing users with only read and browse rights to bypass the write-permission requirement. Exploitation is contingent upon having a hosted NuGet repository with Symbol Server enabled. If anonymous access is allowed, individuals can exploit this issue even without authentication, as the default settings grant the built-in anonymous user read and browse access to all repositories.

References