TI-2026-52887 Aliases CVE-2026-75542

OAuth token exchange grants repository scopes for organizations the principal cannot access

HIGH 69CWE-863Published 2026-08-24 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires. This issue affects hex.pm: from 2025-10-18 before 2026-08-24.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0046 40th percentileScored 2026-11-07

Fix Fixed hexpm (hexpm): 2026-08-24

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hexpm	hexpm	2025-10-18 to before 2026-08-24	2026-08-24	Patch available	CNA

hexpm Vendorhexpm Affected 2025-10-18 to before 2026-08-24 Fixed in 2026-08-24 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hexpm:hexpm::::::::	—	—	—

cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA hexpm (hexpm) Fixed in 2026-08-24

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-24
hexpm 2026-08-24
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-52890 Explicit organization scopes survive token refresh after membership endsPriority MEDIUM 45
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-75542

References

Patch 1

https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8

Advisory 1

https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr

Other 2

TI-2026-24685 Lockfile checksums not verified in Hex allows dependency integrity bypass CVSS 4.0HIGH 8.9
TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
TI-2026-59264 Refresh tokens accepted as private repository credentials at the CDN CVSS 4.0LOW 2.3
TI-2026-52890 Explicit organization scopes survive token refresh after membership ends CVSS 4.0LOW 2.3
TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
TI-2019-15830 Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences