CVE-2026-50892 describes an access control vulnerability in Nginx Proxy Manager v2.14.0's Let's Encrypt certificate download endpoint. Authenticated users can exploit this flaw to obtain TLS private keys via a specially crafted GET request. The vulnerability arises from improper authorization checks on the endpoint responsible for serving certificate material. No CVSS score or vendor advisory is available to confirm patch status or mitigation details.

An attacker with valid authentication can access TLS private key material, potentially compromising the confidentiality and integrity of encrypted communications managed by the affected Nginx Proxy Manager instance. This exposure could allow further attacks such as man-in-the-middle or impersonation of the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Nginx Proxy Manager interface to trusted users only and monitor for unusual access patterns to the certificate download endpoint.