TI-2026-52890 Aliases CVE-2026-75554

Explicit organization scopes survive token refresh after membership ends

MEDIUM 45CWE-613Published 2026-08-24 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime. This issue affects hex.pm: from 2025-10-10 before 2026-08-24.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00427 37th percentileScored 2026-11-07

Fix Fixed hexpm (hexpm): 2026-08-24

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hexpm	hexpm	2025-10-10 to before 2026-08-24	2026-08-24	Patch available	CNA

hexpm Vendorhexpm Affected 2025-10-10 to before 2026-08-24 Fixed in 2026-08-24 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hexpm:hexpm::::::::	—	—	—

cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA hexpm (hexpm) Fixed in 2026-08-24

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-24
hexpm 2026-08-24
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-52887 OAuth token exchange grants repository scopes for organizations the principal cannot accessPriority HIGH 69
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-75554

References

Patch 1

https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0

Advisory 1

https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c

Other 2

TI-2026-24685 Lockfile checksums not verified in Hex allows dependency integrity bypass CVSS 4.0HIGH 8.9
TI-2026-52887 OAuth token exchange grants repository scopes for organizations the principal cannot access CVSS 4.0HIGH 8.3
TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
TI-2026-59264 Refresh tokens accepted as private repository credentials at the CDN CVSS 4.0LOW 2.3
TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
TI-2019-15830 Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences