CVE-2026-17600

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-17600
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17600.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-17600
Downstream
MINI (2)
Published
2026-08-07T16:07:42Z
Modified
2026-09-24T03:45:20Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation
Details

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

Database specific 
{
    "cna_assigner":  "Sonatype",
    "cwe_ids":  [
        "CWE-613"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17600.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.95.0"
                },
                {
                    "introduced":  "1.1.0"
                },
                {
                    "last_affected":  "3.3"
                },
                {
                    "introduced":  "2.6.0-01"
                },
                {
                    "last_affected":  "3.88.0-08"
                },
                {
                    "introduced":  "3.89.0-09"
                },
                {
                    "fixed":  "3.95.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/sonatype/nexus-public

Affected ranges

Type
GIT
Repo
https://github.com/sonatype/nexus-public
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e1778b02409c1d89a2ac005f44280a23c30520d5
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "3.0.0"
        },
        {
            "fixed":  "3.95.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

3.*
3.37.1-01
release-3.*
release-3.20.0-04
release-3.20.1-01
release-3.21.0-05
release-3.22.0-02
release-3.22.1-02
release-3.23.0-03
release-3.24.0-02
release-3.25.0-03
release-3.25.1-02
release-3.26.0-04
release-3.26.1-02
release-3.27.0-03
release-3.28.0-01
release-3.28.1-01
release-3.29.0-02
release-3.29.1-01
release-3.29.2-02
release-3.3.0-01
release-3.30.0-01
release-3.30.1-01
release-3.31.0-01
release-3.31.1-01
release-3.32.0-03
release-3.33.0-01
release-3.33.1-01
release-3.34.0-01
release-3.34.1-01
release-3.35.0-02
release-3.36.0-01
release-3.37.0-01
release-3.37.3-02
release-3.38.0-01
release-3.38.1-01
release-3.39.0-01
release-3.4.0-02
release-3.40.0-03
release-3.41.0-01
release-3.41.1-01
release-3.42.0-01
release-3.43.0-01
release-3.44.0-01
release-3.45.0-01
release-3.45.1-SNAPSHOT
release-3.46.0-01
release-3.47.0-01
release-3.47.1-01
release-3.48.0-01
release-3.49.0-02
release-3.5.0-02
release-3.50.0-01
release-3.51.0-01
release-3.52.0-01
release-3.53.0-01
release-3.53.1-02
release-3.54.1-01
release-3.55.0-01
release-3.56.0-01
release-3.57.0-01
release-3.58.0-01
release-3.58.1-01
release-3.58.1-02
release-3.59.0-01
release-3.60.0-02
release-3.61.0-02
release-3.62.0-01
release-3.63.0-01
release-3.64.0-03
release-3.64.0-04
release-3.65.0-02
release-3.66.0-02
release-3.67.0-03
release-3.67.1-01
release-3.68.0-04
release-3.68.1-02
release-3.69.0-02
release-3.70.0-03
release-3.70.1-02
release-3.71.0-06
release-3.72.0-04
release-3.73.0-12
release-3.74.0-05
release-3.75.0-06
release-3.75.1-01
release-3.76.0-03
release-3.76.1-01
release-3.77.0-08
release-3.77.1-01
release-3.77.2-02
release-3.78.0-14
release-3.78.1-02
release-3.78.2-04
release-3.79.0-09
release-3.79.1-04
release-3.80.0-06
release-3.81.0-08
release-3.81.1-01
release-3.82.0-08
release-3.83.0-08
release-3.83.1-03
release-3.83.2-01
release-3.84.0-03
release-3.84.1-01
release-3.85.0-03
release-3.86.0-08
release-3.86.2-01
release-3.87.0-03
release-3.87.1-01
release-3.88.0-08
release-3.89.0-09
release-3.89.1-02
release-3.90.0-21
release-3.91.0-07
release-3.91.1-04
release-3.92.1-05
release-3.92.2-01
release-3.92.3-01
release-3.93.0-06
release-3.93.1-04
release-3.93.2-01
release-3.94.0-12
release-3.94.1-06

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17600.json"