Access Control Flaw in Nginx Proxy Manager 2.14.0
CVE-2026-50892

6.5MEDIUM

Key Information:

Vendor

Nginx

Status
Nginx Proxy Manager
Vendor
CVE Published:
15 June 2026

What is CVE-2026-50892?

An access control vulnerability in the 'Let's Encrypt' certificate download endpoint of Nginx Proxy Manager version 2.14.0 allows authenticated attackers to exploit the system. By sending a specially crafted GET request, the flaw can lead to the unauthorized exposure of TLS private key material, placing sensitive data at risk and potentially compromising secure communications.

References

https://gist.github.com/pyuysig/2a581564816d0f9240a03bc2d...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.