CVE-2026-75554 (GCVE-0-2026-75554)
Vulnerability from cvelistv5
Published
2026-08-24 20:15
Modified
2026-08-25 19:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-613 - Insufficient Session Expiration
Summary
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.
expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.
This issue affects hex.pm: from 2025-10-10 before 2026-08-24.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75554",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T19:52:35.290936Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T19:53:55.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://hex.pm",
"cpes": [
"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Hexpm.Permissions\u0027",
"\u0027Elixir.Hexpm.OAuth.Tokens\u0027",
"\u0027Elixir.HexpmWeb.API.OAuthController\u0027"
],
"packageName": "hex.pm",
"product": "hexpm",
"programFiles": [
"lib/hexpm/permissions.ex",
"lib/hexpm/oauth/tokens.ex",
"lib/hexpm_web/controllers/api/oauth_controller.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2"
},
{
"name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6"
},
{
"name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2"
}
],
"vendor": "hexpm",
"versions": [
{
"lessThan": "2026-08-24",
"status": "affected",
"version": "2025-10-10",
"versionType": "date"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Hexpm.Permissions\u0027",
"\u0027Elixir.Hexpm.OAuth.Tokens\u0027",
"\u0027Elixir.HexpmWeb.API.OAuthController\u0027"
],
"packageName": "hexpm/hexpm",
"packageURL": "pkg:github/hexpm/hexpm",
"product": "hexpm",
"programFiles": [
"lib/hexpm/permissions.ex",
"lib/hexpm/oauth/tokens.ex",
"lib/hexpm_web/controllers/api/oauth_controller.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2"
},
{
"name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6"
},
{
"name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2"
}
],
"repo": "https://github.com/hexpm/hexpm",
"vendor": "hexpm",
"versions": [
{
"lessThan": "50cffd206490c49c92d7b63c8505949682abedb0",
"status": "affected",
"version": "650faa03af511e74c1b3b49ec12d35666b6984c4",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eexpand_repositories_scope/3\u003c/code\u003e in \u003ccode\u003elib/hexpm/permissions.ex\u003c/code\u003e only rewrites the literal \u003ccode\u003erepositories\u003c/code\u003e scope, so an explicitly granted \u003ccode\u003erepository:\u0026lt;org\u0026gt;\u003c/code\u003e or \u003ccode\u003edocs:\u0026lt;org\u0026gt;\u003c/code\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored \u003ccode\u003egranted_scopes\u003c/code\u003e, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\u003c/p\u003e\n\u003cp\u003eThis issue affects hex.pm: from 2025-10-10 before 2026-08-24.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\n\n`expand_repositories_scope/3` in `lib/hexpm/permissions.ex` only rewrites the literal `repositories` scope, so an explicitly granted `repository:\u003corg\u003e` or `docs:\u003corg\u003e` scope passes through it untouched. The refresh grant re-derives a new token from the stored `granted_scopes`, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\n\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24."
}
],
"value": "Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\n\nexpand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:\u003corg\u003e or docs:\u003corg\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\n\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T20:15:05.791Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75554.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75554"
},
{
"tags": [
"patch"
],
"url": "https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Explicit organization scopes survive token refresh after membership ends"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75554",
"datePublished": "2026-08-24T20:15:05.791Z",
"dateReserved": "2026-08-18T06:00:02.163Z",
"dateUpdated": "2026-08-25T19:53:55.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-75554\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T19:52:35.290936Z\"}}}], \"references\": [{\"url\": \"https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T19:52:43.953Z\"}}], \"cna\": {\"title\": \"Explicit organization scopes survive token refresh after membership ends\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*\"], \"vendor\": \"hexpm\", \"modules\": [\"\u0027Elixir.Hexpm.Permissions\u0027\", \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027\", \"\u0027Elixir.HexpmWeb.API.OAuthController\u0027\"], \"product\": \"hexpm\", \"versions\": [{\"status\": \"affected\", \"version\": \"2025-10-10\", \"lessThan\": \"2026-08-24\", \"versionType\": \"date\"}], \"packageName\": \"hex.pm\", \"programFiles\": [\"lib/hexpm/permissions.ex\", \"lib/hexpm/oauth/tokens.ex\", \"lib/hexpm_web/controllers/api/oauth_controller.ex\"], \"collectionURL\": \"https://hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2\"}, {\"name\": \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6\"}, {\"name\": \"\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2\"}]}, {\"cpes\": [\"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/hexpm/hexpm\", \"vendor\": \"hexpm\", \"modules\": [\"\u0027Elixir.Hexpm.Permissions\u0027\", \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027\", \"\u0027Elixir.HexpmWeb.API.OAuthController\u0027\"], \"product\": \"hexpm\", \"versions\": [{\"status\": \"affected\", \"version\": \"650faa03af511e74c1b3b49ec12d35666b6984c4\", \"lessThan\": \"50cffd206490c49c92d7b63c8505949682abedb0\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/hexpm/hexpm\", \"packageName\": \"hexpm/hexpm\", \"programFiles\": [\"lib/hexpm/permissions.ex\", \"lib/hexpm/oauth/tokens.ex\", \"lib/hexpm_web/controllers/api/oauth_controller.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2\"}, {\"name\": \"\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6\"}, {\"name\": \"\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2\"}]}], \"references\": [{\"url\": \"https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-75554.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-75554\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\\n\\nexpand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:\u003corg\u003e or docs:\u003corg\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\\n\\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eInsufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eexpand_repositories_scope/3\u003c/code\u003e in \u003ccode\u003elib/hexpm/permissions.ex\u003c/code\u003e only rewrites the literal \u003ccode\u003erepositories\u003c/code\u003e scope, so an explicitly granted \u003ccode\u003erepository:\u0026lt;org\u0026gt;\u003c/code\u003e or \u003ccode\u003edocs:\u0026lt;org\u0026gt;\u003c/code\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored \u003ccode\u003egranted_scopes\u003c/code\u003e, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\u003c/p\u003e\\n\u003cp\u003eThis issue affects hex.pm: from 2025-10-10 before 2026-08-24.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\\n\\n`expand_repositories_scope/3` in `lib/hexpm/permissions.ex` only rewrites the literal `repositories` scope, so an explicitly granted `repository:\u003corg\u003e` or `docs:\u003corg\u003e` scope passes through it untouched. The refresh grant re-derives a new token from the stored `granted_scopes`, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\\n\\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-613\", \"description\": \"CWE-613 Insufficient Session Expiration\"}]}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-08-24T20:15:05.791Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-75554\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T19:53:55.535Z\", \"dateReserved\": \"2026-08-18T06:00:02.163Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-08-24T20:15:05.791Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…