CVE-2026-75542

{"id": "CVE-2026-75542", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75542", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:53:10.499908Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"], "vendor": "hexpm", "modules": ["'Elixir.HexpmWeb.API.OAuthController'", "'Elixir.Hexpm.OAuth.Tokens'"], "product": "hexpm", "versions": [{"status": "affected", "version": "2025-10-18", "lessThan": "2026-08-24", "versionType": "date"}], "packageName": "hex.pm", "programFiles": ["lib/hexpm_web/controllers/api/oauth_controller.ex", "lib/hexpm/oauth/tokens.ex"], "collectionURL": "https://hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.HexpmWeb.API.OAuthController':validate_scopes_against_key/2"}, {"name": "'Elixir.Hexpm.OAuth.Tokens':create_for_org/6"}]}, {"cpes": ["cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"], "repo": "https://github.com/hexpm/hexpm", "vendor": "hexpm", "modules": ["'Elixir.HexpmWeb.API.OAuthController'", "'Elixir.Hexpm.OAuth.Tokens'"], "product": "hexpm", "versions": [{"status": "affected", "version": "71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b", "lessThan": "bf0fb9d208f0acfabf7a2f7467c8231659e322a8", "versionType": "git"}], "packageURL": "pkg:github/hexpm/hexpm", "packageName": "hexpm/hexpm", "programFiles": ["lib/hexpm_web/controllers/api/oauth_controller.ex", "lib/hexpm/oauth/tokens.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.HexpmWeb.API.OAuthController':validate_scopes_against_key/2"}, {"name": "'Elixir.Hexpm.OAuth.Tokens':create_for_org/6"}]}]}], "published": "2026-08-24T21:17:47.373", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-75542.html", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75542", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages.\n\nWhen an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires.\n\nThis issue affects hex.pm: from 2025-10-18 before 2026-08-24."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n incorrecta en el endpoint de token de OAuth en hexpm hexpm permite que una clave API que posee el permiso de repositorios lea los paquetes privados de otra organizaci\u00f3n.\n\nCuando una clave API se intercambia por un token a trav\u00e9s de la concesi\u00f3n client_credentials de OAuth, validate_scopes_against_key/2 en lib/hexpm_web/controllers/api/oauth_controller.ex admite un \u00e1mbito solicitado siempre que la clave posea el permiso de repositorios y la cadena de \u00e1mbito comience con repository:. El nombre de la organizaci\u00f3n nunca se resuelve contra el principal, y expand_repositories_scope/3 solo reescribe el \u00e1mbito literal de repositorios, por lo que un repository:<name> expl\u00edcito pasa sin ser modificado. Ambos nodos perimetrales de CDN autorizan el acceso al repositorio a partir de la declaraci\u00f3n del token sin consultar la base de datos, por lo que el token emitido es acceso de lectura a los paquetes privados de esa organizaci\u00f3n hasta que expire.\n\nEste problema afecta a hex.pm: desde el 18-10-2025 antes del 24-08-2026."}], "lastModified": "2026-10-12T21:10:00.227", "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}