CVE-2026-14644
Received Received - Intake

Privilege Escalation in Nexus Repository 3 via Type Confusion

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Sonatype

Description
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-14644
EUVD
EUVD-2026-54522

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sonatype nexus_repository From 3.19.0 (inc) to 3.94.x (inc)
sonatype nexus_repository 3.95.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14644 is a privilege escalation vulnerability in Sonatype Nexus Repository 3. It allows an authenticated user with specific permissions to escalate their access to full administrator privileges by exploiting a type-confusion flaw in the REST privileges API.

Detection Guidance

To detect this vulnerability, check Nexus Repository versions between 3.19.0 and 3.94.x. Verify if any user with nx-privileges-update permission has custom privileges assigned. Review audit logs for suspicious privilege escalation attempts in the REST API.

Impact Analysis

If exploited, an attacker with limited access could gain full administrative control over the Nexus Repository instance. This could lead to unauthorized access, data manipulation, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Full administrative access may allow attackers to exfiltrate or alter protected data.

Mitigation Strategies

Immediately upgrade Nexus Repository to version 3.95.0 or later. If upgrading is not possible, restrict nx-privileges-update permission to trusted administrators only and audit custom privileges to remove unnecessary grants.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart