CVE-2026-77124

HighCVSS 7.2/10Last modified Sep 22, 2026

Description

In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184

Affected software

Vendor	Product	Versions
Sonatype	Nexus Repository 3	>= 3.21.2, < 3.96.0

References

https://help.sonatype.com/en/sonatype-nexus-repository-3-96-0-release-notes.htmlRelease Notes
https://support.sonatype.com/hc/en-us/articles/54641528273811/Mitigation, Vendor Advisory

Timeline

Published: Sep 2, 2026
Last modified: Sep 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-771257.1A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly e CVE-2026-771276.0The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authen CVE-2026-771286.3The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-o CVE-2026-771297.7The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user w CVE-2026-77136.3A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_au CVE-2026-771305.3The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key t CVE-2026-771315.3When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitat CVE-2026-771325.3It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowe CVE-2026-771336.0The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses CVE-2026-771348.3The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmat CVE-2026-771358.2The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visit CVE-2026-771369.5The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as