PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75542 hexpm CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-24T21:17:47.373Z and has not been modified since then. CVE-2026-75542 is an Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm. An API key holding the repositories permission can read another organization's private packages. The vulnerability arises because validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope. As a result, an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires. This issue affects hex.pm: from 2025-10-18 before 2026-08-24. Organizations should verify their inventory and ensure the patched version is deployed, focusing on tokens issued with repository access.

Vendor
hexpm
Product
Unknown
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-24
Original CVE updated
2026-09-01
Advisory published
2026-08-24
Advisory updated
2026-09-01

Who should care

Organizations using hexpm for package management, especially those with multiple repositories and strict access controls, should prioritize patching and reviewing their current token and API key configurations.

Technical summary

The hexpm OAuth token endpoint incorrectly authorizes API keys with repository permissions, allowing access to private packages across organizations. This occurs because the validate_scopes_against_key/2 function admits scopes starting with 'repository:' without proper organization resolution. As a result, tokens minted with such API keys can be used to read private packages from other organizations until they expire.

Defensive priority

Organizations using hexpm should verify their inventory and ensure the patched version is deployed, focusing on tokens issued with repository access.

Recommended defensive actions

  • Verify inventory of hexpm installations for patched version 2026-08-24 or later.
  • Review and restrict repository access for API keys and OAuth tokens.
  • Monitor for suspicious repository access patterns.
  • Implement compensating controls for sensitive package access.
  • Update documentation for secure token management.

Evidence notes

The CVE-2026-75542 issue arises from incorrect authorization in the OAuth token endpoint of hexpm, allowing an API key with repository permission to read another organization's private packages. The vulnerability exists because validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits scopes starting with 'repository:' if the key has repository permission, without resolving the organization name against the principal. This results in tokens providing read access to private packages of other organizations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75542 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75542

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75542 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75542

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-75542.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-75542

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.