CVE-2026-75554
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
hexpm (hex.pm) has a vulnerability due to insufficient session expiration in the OAuth token refresh grant. A user removed from an organization can still read private packages because permission scopes are not properly updated. Affects hex.pm from 2025-10-10 before 2026-08-24.
Risk Assessment
Former organization members may retain access to private packages, leading to confidentiality and access control breaches.
Recommendation
Update hex.pm to a patched version (2026-08-24 or later) and review token refresh mechanisms.
Other vulnerabilities in hexpm
See all- CVE-2026-75542High
An incorrect authorization vulnerability in the OAuth token endpoint in hexpm allows an API key with the repositories permission to read another organization's private packages. During key exchange for a token, scope validation does not resolve the organization name against the principal, and repository:<name> scope passes through unchanged. The token grants read access to that organization's private packages until expiration.
- CVE-2026-23940Medium
In hexpm/hexpm before commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 and hex.pm before 2026-03-10, an uncontrolled resource consumption vulnerability exists. Publishing an oversized package can cause memory exhaustion during tarball extraction, leading to denial of service.
- CVE-2026-21618Medium
hexpm (hex.pm) has a Cross-Site Scripting (XSS) vulnerability in the Elixir.HexpmWeb.SharedAuthorizationView module. The render_grouped_scopes/3 function does not sanitize input, allowing script injection.
Original NVD description (English source)
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime. This issue affects hex.pm: from 2025-10-10 before 2026-08-24.