{"id":"CVE-2026-113368","kind":"vulnerability","aliases":["CVE-2026-113368"],"related":[],"title":"Sonatype Nexus Repository 3: group repositories expose unauthorized member repositories","description":"Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege on a group repository can add a repository that the account cannot read or browse, and then read the content of that repository through the group. The anonymous user can only do this if an administrator has explicitly granted it that privilege.","summary":"Sonatype Nexus Repository 3 does not check that a user can read a repository before adding it to a group repository. A signed-in user with add or edit rights on a group can then read the content of repositories they were never allowed to access.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["artifact-repository","infrastructure","nexus-repository","self-hosted"],"not_affected_if":["anonymous-add-privilege-not-granted","no-group-repositories","single-user"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-04T20:18:55+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","triaged_at":"2026-11-04T20:30:06+00:00","updated_at":"2026-11-04T20:30:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T20:30:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sonatype Nexus Repository 3: group repositories expose unauthorized member repositories","impact":"medium","summary":"Sonatype Nexus Repository 3 does not check that a user can read a repository before adding it to a group repository. A signed-in user with add or edit rights on a group can then read the content of repositories they were never allowed to access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nexus-repository","self-hosted","artifact-repository"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated users read content from repositories they lack access to.","analyst_note":"Check the NVD entry and the Sonatype advisory for affected and fixed Nexus 3 versions; sources here give no version ranges or fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-user","no-group-repositories","anonymous-add-privilege-not-granted"],"who_is_affected":"Teams that run Sonatype Nexus Repository 3 with group repositories and multiple user accounts are exposed, since the flaw lets a user with group add or edit rights read repositories they cannot otherwise access. Single-user instances, or instances where no one holds group edit rights, have a much smaller exposure. The anonymous user is only affected if an administrator has granted it that privilege.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4155,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113368':13A,16A '-2026':12A,15A '3':4A,30B,77C 'access':73B,88C 'account':84C,105C,130C 'add':42B,54B,95C,116C,125C 'administr':155C 'allow':71B 'anonym':147C 'artifact':18B 'artifact-repositori':17B 'author':86C 'brows':134C 'cannot':131C 'check':33B,80C 'content':65B,139C 'credenti':112C 'cve':11A,14A 'edit':56B,118C 'explicit':157C 'expos':7A 'grant':158C 'group':5A,46B,60B,101C,122C,145C 'hold':114C 'host':26B 'infrastructur':20B 'member':9A,98C 'never':70B 'nexus':2A,22B,28B,75C 'nexus-repositori':21B 'privileg':119C,161C 'read':38B,63B,132C,137C 'repositori':3A,6A,10A,19B,23B,29B,40B,47B,67B,76C,90C,93C,102C,123C,127C,142C 'right':57B 'self':25B 'self-host':24B 'sign':50B,108C 'signed-in':49B 'sonatyp':1A,27B,74C 'unauthor':8A 'user':36B,52B,83C,104C,148C 'valid':111C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Sonatype Nexus Repository 3 with group repositories and multiple user accounts are exposed, since the flaw lets a user with group add or edit rights read repositories they cannot otherwise access. Single-user instances, or instances where no one holds group edit rights, have a much smaller exposure. The anonymous user is only affected if an administrator has granted it that privilege.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["artifactrepository","infrastructure","medium","nexusrepository","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T20:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"103e4ec9-0a87-450b-af77-479448ddef11","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113368","severity":null,"published_at":"2026-11-04T20:18:55+00:00","modified_at":"2026-11-04T20:18:55+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","fetched_at":"2026-11-04T20:29:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}