CVE-2026-75542

OAuth token exchange grants repository scopes for organizations the principal cannot access

State: Published
Severity: 8.3 High
Published: Aug 24, 2026
Updated: Aug 25, 2026
Reserved: Aug 18, 2026

Description

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages.

When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires.

This issue affects hex.pm: from 2025-10-18 before 2026-08-24.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	EEF

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
hexpmhexpm	2025-10-18 to before 2026-08-24Affected
hexpmhexpm	71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b to before bf0fb9d208f0acfabf7a2f7467c8231659e322a8Affected

References

https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cprvendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-75542.htmlrelated
https://osv.dev/vulnerability/EEF-CVE-2026-75542related
https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.