Vulnerability Details CVE-2026-14504
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 38.3%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-14504
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2