CVE-2026-75542

Name of the Vulnerable Software and Affected Versions hexpm versions 2025-10-18 through 2026-08-23

Description An incorrect authorization issue exists in the OAuth token endpoint. An API key with the repositories permission can be used to read private packages belonging to another organization. This occurs during the OAuth client credentials grant process within the validate scopes against key/2 function in lib/hexpm web/controllers/api/oauth controller.ex, which allows a requested scope if the key has repositories permission and the scope string starts with repository:. Because the organization name is not resolved against the principal and the expand repositories scope/3 function only rewrites the literal repositories scope, an explicit repository:<name> scope is accepted. Consequently, CDN edges authorize access based on the token claim without database verification, granting read access to the specified organization's private packages until the token expires.

Recommendations Update hexpm to a version released on or after 2026-08-24.