Auth bypass in Sonatype Nexus Repository 3

CVE-2026-14504

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.

Vulnerability class: Broken Access Control

EPSS: 0.004 (37.1th percentile) — read the EPSS interpretation.