medium6.5
CVE-2026-14504
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted rep…
Impact
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sonatype | Nexus Repository Manager | from 3.88.0 before 3.94.0 |