CVE-2026-14644CWE-843

CVE-2026-14644

High · published August 7, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2026-08-07T21:16Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.19.0, < 3.95.03.95.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/53157550694675 · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 07 AUG 16:07Z
    Nexus Repository 3 - Privilege Escalation
    cvelistv5