CVE-2026-75554
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
hexpm (hex.pm) has a vulnerability due to insufficient session expiration in the OAuth token refresh grant. A user removed from an organization can still read private packages because permission scopes are not properly updated. Affects hex.pm from 2025-10-10 before 2026-08-24.
Risk Assessment
Former organization members may retain access to private packages, leading to confidentiality and access control breaches.
Recommendation
Update hex.pm to a patched version (2026-08-24 or later) and review token refresh mechanisms.
Other vulnerabilities in hexpm
See all- CVE-2026-86698Low
hexpm (hex.pm) has a vulnerability of insufficient session expiration in OAuth tokens. A user whose organization membership or session has ended can still read the organization's private packages and documentation via a retained refresh token. Access is read-only and limited to organizations the account belonged to when the token was granted.
- CVE-2026-75542High
An incorrect authorization vulnerability in the OAuth token endpoint in hexpm allows an API key with the repositories permission to read another organization's private packages. During key exchange for a token, scope validation does not resolve the organization name against the principal, and repository:<name> scope passes through unchanged. The token grants read access to that organization's private packages until expiration.
- CVE-2026-21618Medium
hexpm (hex.pm) has a Cross-Site Scripting (XSS) vulnerability in the Elixir.HexpmWeb.SharedAuthorizationView module. The render_grouped_scopes/3 function does not sanitize input, allowing script injection.
Original NVD description (English source)
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime. This issue affects hex.pm: from 2025-10-10 before 2026-08-24.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS