Nginx Proxy Manager 2.14.0 returns private TLS key material through the certificate download API. A user with certificate read access can download a ZIP archive containing privkey.pem for the selected certificate.
The route GET /api/nginx/certificates/:certificate_id/download is handled by backend/internal/certificate.js::download(). The handler packages files from the live certificate directory into a ZIP archive.
The authorization boundary is certificate read access, such as the certificates:get capability for the target certificate. The returned archive includes private key files from the certificate directory instead of limiting the response to public certificate or chain material.
The affected object is the private key associated with the selected Nginx Proxy Manager certificate. This issue is distinct from creating or importing a certificate; the disclosure occurs through the existing download endpoint.
- Log in to Nginx Proxy Manager 2.14.0 as a user with certificate read access, such as the
certificates:getpermission for a certificate. - Send
GET /api/nginx/certificates/{certificate_id}/downloadfor a certificate visible to that user. - Save and unzip the returned archive.
- Observe private key material such as
privkey.pemincluded alongside the certificate files. - Compare the result with the expected read-only certificate visibility boundary and confirm that private key material is included in the downloaded package.
The observed result is disclosure of the selected certificate's private key to a user who should only need certificate read visibility. Possession of the key can allow impersonation of the TLS endpoint and requires key rotation for the affected certificate.