CVE-2026-75554

{"id": "CVE-2026-75554", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75554", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:52:35.290936Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"], "vendor": "hexpm", "modules": ["'Elixir.Hexpm.Permissions'", "'Elixir.Hexpm.OAuth.Tokens'", "'Elixir.HexpmWeb.API.OAuthController'"], "product": "hexpm", "versions": [{"status": "affected", "version": "2025-10-10", "lessThan": "2026-08-24", "versionType": "date"}], "packageName": "hex.pm", "programFiles": ["lib/hexpm/permissions.ex", "lib/hexpm/oauth/tokens.ex", "lib/hexpm_web/controllers/api/oauth_controller.ex"], "collectionURL": "https://hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Hexpm.Permissions':expand_repositories_scope/2"}, {"name": "'Elixir.Hexpm.OAuth.Tokens':create_for_user/6"}, {"name": "'Elixir.HexpmWeb.API.OAuthController':handle_refresh_token_grant/2"}]}, {"cpes": ["cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"], "repo": "https://github.com/hexpm/hexpm", "vendor": "hexpm", "modules": ["'Elixir.Hexpm.Permissions'", "'Elixir.Hexpm.OAuth.Tokens'", "'Elixir.HexpmWeb.API.OAuthController'"], "product": "hexpm", "versions": [{"status": "affected", "version": "650faa03af511e74c1b3b49ec12d35666b6984c4", "lessThan": "50cffd206490c49c92d7b63c8505949682abedb0", "versionType": "git"}], "packageURL": "pkg:github/hexpm/hexpm", "packageName": "hexpm/hexpm", "programFiles": ["lib/hexpm/permissions.ex", "lib/hexpm/oauth/tokens.ex", "lib/hexpm_web/controllers/api/oauth_controller.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Hexpm.Permissions':expand_repositories_scope/2"}, {"name": "'Elixir.Hexpm.OAuth.Tokens':create_for_user/6"}, {"name": "'Elixir.HexpmWeb.API.OAuthController':handle_refresh_token_grant/2"}]}]}], "published": "2026-08-24T21:17:47.557", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-75554.html", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75554", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\n\nexpand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\n\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24."}, {"lang": "es", "value": "Vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente en la concesi\u00f3n de actualizaci\u00f3n de token OAuth en hexpm hexpm permite a un usuario eliminado de una organizaci\u00f3n seguir leyendo sus paquetes privados.\n\nexpand_repositories_scope/3 en lib/hexpm/permissions.ex solo reescribe el \u00e1mbito literal de los repositorios, por lo que un \u00e1mbito repository:<org> o docs:<org> concedido expl\u00edcitamente lo atraviesa intacto. La concesi\u00f3n de actualizaci\u00f3n vuelve a derivar un nuevo token de los granted_scopes almacenados, que contiene esa forma expandida, por lo que cada actualizaci\u00f3n reproduce el \u00e1mbito de la organizaci\u00f3n sin revisar la membres\u00eda. Debido a que ambos nodos perimetrales de CDN autorizan el acceso al repositorio desde la declaraci\u00f3n del token sin consultar la base de datos, una cuenta eliminada de una organizaci\u00f3n retiene el acceso de lectura mientras siga actualizando, limitada por la vida \u00fatil del token de actualizaci\u00f3n de 30 d\u00edas en lugar de la vida \u00fatil del token de acceso de 30 minutos.\n\nEste problema afecta a hex.pm: desde 2025-10-10 antes de 2026-08-24."}], "lastModified": "2026-10-12T21:10:00.227", "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}