Vulnerability in Sonatype Nexus Repository 3

CVE-2026-14644

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

EPSS: 0.003 (19.5th percentile) — read the EPSS interpretation.