Vulnerability Description
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires. This issue affects hex.pm: from 2025-10-18 before 2026-08-24.
Related Weaknesses (CWE)
References
- https://cna.erlef.org/cves/CVE-2026-75542.html
- https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8
- https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr
- https://osv.dev/vulnerability/EEF-CVE-2026-75542
- https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr
FAQ
What is CVE-2026-75542?
CVE-2026-75542 is a documented vulnerability. Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key...
How severe is CVE-2026-75542?
CVSS scoring is not yet available for CVE-2026-75542. Check NVD for updates.
Is there a patch for CVE-2026-75542?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.