CVE-2026-77125 is a high severity (7.1) authorization flaw in Sonatype Nexus Repository 3. A user with only the blobstores create permission could convert an existing blobstore into a group blobstore, an action that should need the update permission. Sonatype's advisory names the fixed version, so check it.
What's affected
The record says two blobstore group management REST API endpoints in Nexus Repository 3 did not enforce the intended authorization check. It gives no version range and no fixed version.
The record cites Sonatype's 3.96.0 release notes and a support article. The release notes we read do not mention blobstore groups, and the support article was behind a browser check we could not pass. We therefore cannot confirm a fixed version, and we are not stating one. Check Sonatype's advisory.
Where sources differ. With only the record to go on, there is no second source for severity or versions. The record says 7.1 High. The nexus:blobstores:create permission is a named permission that must be explicitly granted, and it is not held by default, which limits who can reach the flaw.
How to check if you're exposed
Start with permissions, since the flaw depends on one. In the Nexus administration interface, list roles that include nexus:blobstores:create and the users and groups assigned to them. Compare that list with who should be able to change blobstore configuration.
Then check your version in the interface and compare it with the fixed version in Sonatype's advisory.
Finally, review your existing blobstores for any group blobstore that nobody remembers creating. A changed storage layout is the kind of change that is easy to miss.
What to do now
- Read Sonatype's advisory and confirm the fixed version, then upgrade.
- Audit roles that carry nexus:blobstores:create and remove the permission where it is not needed.
- Review blobstore configuration for unexpected group blobstores.
- Ask whether anyone needs create without update. If not, grant them together or not at all.
- Re-test after upgrading that create alone cannot convert a blobstore.
Why it matters
The record says two endpoints checked for the wrong permission. A person with create could do something that should have required update. That is incorrect authorization, filed under CWE-863, and it is the kind of bug that appears when an API grows endpoints faster than its permission model.
The impact is on integrity of configuration, with some confidentiality exposure, because blobstores hold the artifacts your builds depend on. Since the permission is not granted by default, the realistic population is small: administrators who delegated storage rights to a team. That is also the group least likely to be watching for the change. The record does not mark it as a CISA KEV entry.
Quick check
Who is exposed?
Accounts that hold the nexus:blobstores:create permission, which an administrator must grant explicitly. It is not held by default.
Do we know the fixed version?
Not from the pages we could read. Check Sonatype's advisory for the version.
Sources
Last reviewed: 18 October 2026.
