What is CVE-2026-17594?
CVE-2026-17594 is an incorrect authorization vulnerability (CWE-863) in the repository-creation UI of Nexus Repository 3 CE/Pro. An attacker with delegated repository-admin privileges scoped to a single format can bypass restrictions and create a repository of a different format. Applying the relevant patches or upgrading is recommended to enforce proper privilege scoping.
Azərbaycanca: CVE-2026-17594, Nexus Repository 3 CE/Pro versiyalarında repository yaradılması interfeysində səlahiyyət yoxlaması səhvini (CWE-863) təsvir edir. Bu boşluq, yalnız müəyyən bir repository formatı üçün verilmiş admin hüququna malik istifadəçiyə başqa formatda repository yaratmağa imkan verir. İstifadəçilərə verilən səlahiyyətləri məhdudlaşdırmaq üçün müvafiq yamaq tətbiq edilməlidir.
Related CVEs
link basis: same weakness class CWE-863
FAQ2
What privilege restriction does CVE-2026-17594 allow bypassing in Nexus Repository?
This vulnerability allows a user with delegated repository-admin privileges scoped to a single format (e.g., Maven) to create a repository of a different format (e.g., Docker), thereby bypassing the intended privilege scoping.
How can the impact of CVE-2026-17594 be mitigated?
Apply the relevant patches released by the vendor or upgrade Nexus Repository 3 CE/Pro to the latest version to enforce proper privilege scoping.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.