Incorrect Authorization Vulnerability in hexpm Affected by API Key Mismanagement

CVE-2026-75542

What is CVE-2026-75542?

The vulnerability involves a flaw in the OAuth token endpoint of hexpm, where an API key with repositories permission can inadvertently gain access to another organization's private packages. This occurs if the key is exchanged for a token without adequate validation of the associated organization. The issue stems from the fact that the system accepts scope requests without verifying ownership against the principal, allowing explicit repository access to potentially sensitive data. Immediate action is recommended to mitigate unauthorized access risks.

References