CVE-2026-14644

Published: Ago 07, 2026 Last Modified: Ago 07, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,6
Source: 103e4ec9-0a87-450b-af77-479448ddef11
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

843

Access of Resource Using Incompatible Type ('Type Confusion')

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality
Potential Impacts:
Read Memory Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart
Applicable Platforms
Languages: C, C++
View CWE Details
https://help.sonatype.com/en/sonatype-nexus-repository-3-95…
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
https://support.sonatype.com/hc/en-us/articles/531575506946…
https://support.sonatype.com/hc/en-us/articles/53157550694675