Threats affecting pkg:npm/nginx-proxy-manager

Nginx Proxy Manager version 2.14.0 contains an incorrect access control vulnerability in the Let's Encrypt certificate download endpoint. This flaw allows authenticated attackers to retrieve TLS private key material by sending a crafted GET request. The vulnerability has a CVSS score of 6.5, indicating medium severity. No official patch or remediation guidance is currently available.