https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:03:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-359021 EUVD-2026-359021 https://cve.radiocsirt.org/vuln/euvd-2026-359021 https://cve.radiocsirt.org/vuln/fkie_cve-2026-75542 <p>Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization&#39;s private packages.</p> <p>When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:&lt;name&gt; passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization&#39;s private packages until it expires.</p> <p>This issue affects hex.pm: from 2025-10-18 before 2026-08-24.</p> <p>Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization&#39;s private packages.</p> <p>When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:&lt;name&gt; passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization&#39;s private packages until it expires.</p> <p>This issue affects hex.pm: from 2025-10-18 before 2026-08-24.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-75542