CVE-2026-75542 (GCVE-0-2026-75542)
Vulnerability from cvelistv5
Published
2026-08-24 20:14
Modified
2026-08-25 19:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - Incorrect Authorization
Summary
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages.
When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires.
This issue affects hex.pm: from 2025-10-18 before 2026-08-24.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75542",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T19:53:10.499908Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T19:53:26.196Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://hex.pm",
"cpes": [
"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HexpmWeb.API.OAuthController\u0027",
"\u0027Elixir.Hexpm.OAuth.Tokens\u0027"
],
"packageName": "hex.pm",
"product": "hexpm",
"programFiles": [
"lib/hexpm_web/controllers/api/oauth_controller.ex",
"lib/hexpm/oauth/tokens.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:validate_scopes_against_key/2"
},
{
"name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_org/6"
}
],
"vendor": "hexpm",
"versions": [
{
"lessThan": "2026-08-24",
"status": "affected",
"version": "2025-10-18",
"versionType": "date"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HexpmWeb.API.OAuthController\u0027",
"\u0027Elixir.Hexpm.OAuth.Tokens\u0027"
],
"packageName": "hexpm/hexpm",
"packageURL": "pkg:github/hexpm/hexpm",
"product": "hexpm",
"programFiles": [
"lib/hexpm_web/controllers/api/oauth_controller.ex",
"lib/hexpm/oauth/tokens.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:validate_scopes_against_key/2"
},
{
"name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_org/6"
}
],
"repo": "https://github.com/hexpm/hexpm",
"vendor": "hexpm",
"versions": [
{
"lessThan": "bf0fb9d208f0acfabf7a2f7467c8231659e322a8",
"status": "affected",
"version": "71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the \u003ccode\u003erepositories\u003c/code\u003e permission to read another organization\u0027s private packages.\u003c/p\u003e\n\u003cp\u003eWhen an API key is exchanged for a token through the OAuth \u003ccode\u003eclient_credentials\u003c/code\u003e grant, \u003ccode\u003evalidate_scopes_against_key/2\u003c/code\u003e in \u003ccode\u003elib/hexpm_web/controllers/api/oauth_controller.ex\u003c/code\u003e admits a requested scope whenever the key carries the \u003ccode\u003erepositories\u003c/code\u003e permission and the scope string begins with \u003ccode\u003erepository:\u003c/code\u003e. The organization name is never resolved against the principal, and \u003ccode\u003eexpand_repositories_scope/3\u003c/code\u003e only rewrites the literal \u003ccode\u003erepositories\u003c/code\u003e scope, so an explicit \u003ccode\u003erepository:\u0026lt;name\u0026gt;\u003c/code\u003e passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization\u0027s private packages until it expires.\u003c/p\u003e\n\u003cp\u003eThis issue affects hex.pm: from 2025-10-18 before 2026-08-24.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the `repositories` permission to read another organization\u0027s private packages.\n\nWhen an API key is exchanged for a token through the OAuth `client_credentials` grant, `validate_scopes_against_key/2` in `lib/hexpm_web/controllers/api/oauth_controller.ex` admits a requested scope whenever the key carries the `repositories` permission and the scope string begins with `repository:`. The organization name is never resolved against the principal, and `expand_repositories_scope/3` only rewrites the literal `repositories` scope, so an explicit `repository:\u003cname\u003e` passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization\u0027s private packages until it expires.\n\nThis issue affects hex.pm: from 2025-10-18 before 2026-08-24."
}
],
"value": "Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization\u0027s private packages.\n\nWhen an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:\u003cname\u003e passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization\u0027s private packages until it expires.\n\nThis issue affects hex.pm: from 2025-10-18 before 2026-08-24."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T20:14:30.191Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75542.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75542"
},
{
"tags": [
"patch"
],
"url": "https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "OAuth token exchange grants repository scopes for organizations the principal cannot access"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75542",
"datePublished": "2026-08-24T20:14:30.191Z",
"dateReserved": "2026-08-18T11:00:02.414Z",
"dateUpdated": "2026-08-25T19:53:26.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-75542\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T19:53:10.499908Z\"}}}], \"references\": [{\"url\": \"https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T19:53:18.808Z\"}}], \"cna\": {\"title\": \"OAuth token exchange grants repository scopes for organizations the principal cannot access\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*\"], \"vendor\": \"hexpm\", \"modules\": [\"\u0027Elixir.HexpmWeb.API.OAuthController\u0027\", \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027\"], \"product\": \"hexpm\", \"versions\": [{\"status\": \"affected\", \"version\": \"2025-10-18\", \"lessThan\": \"2026-08-24\", \"versionType\": \"date\"}], \"packageName\": \"hex.pm\", \"programFiles\": [\"lib/hexpm_web/controllers/api/oauth_controller.ex\", \"lib/hexpm/oauth/tokens.ex\"], \"collectionURL\": \"https://hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.HexpmWeb.API.OAuthController\u0027:validate_scopes_against_key/2\"}, {\"name\": \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_org/6\"}]}, {\"cpes\": [\"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/hexpm/hexpm\", \"vendor\": \"hexpm\", \"modules\": [\"\u0027Elixir.HexpmWeb.API.OAuthController\u0027\", \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027\"], \"product\": \"hexpm\", \"versions\": [{\"status\": \"affected\", \"version\": \"71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b\", \"lessThan\": \"bf0fb9d208f0acfabf7a2f7467c8231659e322a8\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/hexpm/hexpm\", \"packageName\": \"hexpm/hexpm\", \"programFiles\": [\"lib/hexpm_web/controllers/api/oauth_controller.ex\", \"lib/hexpm/oauth/tokens.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.HexpmWeb.API.OAuthController\u0027:validate_scopes_against_key/2\"}, {\"name\": \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_org/6\"}]}], \"references\": [{\"url\": \"https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-75542.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-75542\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization\u0027s private packages.\\n\\nWhen an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:\u003cname\u003e passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization\u0027s private packages until it expires.\\n\\nThis issue affects hex.pm: from 2025-10-18 before 2026-08-24.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIncorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the \u003ccode\u003erepositories\u003c/code\u003e permission to read another organization\u0027s private packages.\u003c/p\u003e\\n\u003cp\u003eWhen an API key is exchanged for a token through the OAuth \u003ccode\u003eclient_credentials\u003c/code\u003e grant, \u003ccode\u003evalidate_scopes_against_key/2\u003c/code\u003e in \u003ccode\u003elib/hexpm_web/controllers/api/oauth_controller.ex\u003c/code\u003e admits a requested scope whenever the key carries the \u003ccode\u003erepositories\u003c/code\u003e permission and the scope string begins with \u003ccode\u003erepository:\u003c/code\u003e. The organization name is never resolved against the principal, and \u003ccode\u003eexpand_repositories_scope/3\u003c/code\u003e only rewrites the literal \u003ccode\u003erepositories\u003c/code\u003e scope, so an explicit \u003ccode\u003erepository:\u0026lt;name\u0026gt;\u003c/code\u003e passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization\u0027s private packages until it expires.\u003c/p\u003e\\n\u003cp\u003eThis issue affects hex.pm: from 2025-10-18 before 2026-08-24.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the `repositories` permission to read another organization\u0027s private packages.\\n\\nWhen an API key is exchanged for a token through the OAuth `client_credentials` grant, `validate_scopes_against_key/2` in `lib/hexpm_web/controllers/api/oauth_controller.ex` admits a requested scope whenever the key carries the `repositories` permission and the scope string begins with `repository:`. The organization name is never resolved against the principal, and `expand_repositories_scope/3` only rewrites the literal `repositories` scope, so an explicit `repository:\u003cname\u003e` passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization\u0027s private packages until it expires.\\n\\nThis issue affects hex.pm: from 2025-10-18 before 2026-08-24.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-08-24T20:14:30.191Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-75542\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T19:53:26.196Z\", \"dateReserved\": \"2026-08-18T11:00:02.414Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-08-24T20:14:30.191Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…