Sonatype Nexus Repository 3 version 3.19.0 contains a CWE-843 type confusion vulnerability in its REST privileges API. An authenticated user with privilege management rights can exploit this flaw in the privilege update endpoint to escalate their privileges to full administrator. This vulnerability arises from improper handling of resource types during privilege updates, enabling unauthorized privilege escalation.

Successful exploitation allows an authenticated user with limited privilege management permissions to escalate to full administrator access, potentially compromising the entire repository management system. This can lead to unauthorized access, modification, or deletion of repository data and configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privilege management permissions to trusted users only and monitor for suspicious privilege changes.