Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75554— Explicit organization scopes survive token refresh after membership ends

Quick assessment

Affected
hexpm hexpm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Hex.pm 中 OAuth 令牌刷新授予存在会话过期机制不足的安全漏洞，该漏洞允许已被某个组织移除的用户继续访问该组织的私有包。 文件中的 函数仅重写字面量的仓库范围（repositories scope），因此显式授予的 或 范围会原封不动地通过该函数，未被正确处理。令牌刷新机制会从存储的 （已授予范围）中重新派生新令牌，而 中保存的是经过扩展后的范围形式。因此，每次刷新令牌时都会重新包含该组织的范围信息，而无需重新验证用户是否仍属于该组织成员。 由于 CDN 边缘节点在验证仓库访问权限时，仅依赖令牌中的声明信

CVSS 2.3 · Low EPSS 0.25% · P16
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75554

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Explicit organization scopes survive token refresh after membership ends
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime. This issue affects hex.pm: from 2025-10-10 before 2026-08-24.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
hexpm hexpm 2025-10-10 ~ 2026-08-24 cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
hexpm hexpm 650faa03af511e74c1b3b49ec12d35666b6984c4 ~ 50cffd206490c49c92d7b63c8505949682abedb0 cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-75554

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75554

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75554 (1)

Vendor Advisories for CVE-2026-75554 (3)

IV. Related Vulnerabilities

Same product: hexpm
Same vendor: hexpm
Same weakness: CWE-613

V. Comments for CVE-2026-75554

No comments yet

Leave a comment