Quick answers
- Is CVE-2026-75554 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-75554 being exploited in the wild.
- How severe is CVE-2026-75554?
- Informational severity, published 24 August 2026.
- Which products and versions are affected?
- Hex.pm from 2025-10-10 before 2026-08-24.
- Is there a fix for CVE-2026-75554?
- A patch was published on 2026-08-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-75554 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-75554?
- Check whether you run Hex.pm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an insufficient session expiration issue in the OAuth token refresh grant flow. The root cause is in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal "repositories" scope but allows explicitly granted scopes like "repository:<org>" or "docs:<org>" to pass through unchanged. During token refresh, a new access token is derived from the stored granted_scopes, which contains the expanded organization-specific scopes, bypassing membership verification. Because CDN edges authorize repository access using the token claims directly without querying the database, a user removed from an organization can maintain read access as long as they keep refreshing their token—bounded by the 30-day refresh token lifetime rather than the 30-minute access token lifetime. Network-based token refresh is required; no authentication bypass is needed beyond possessing a valid refresh token.
Affected products
- Hex.pm Hex.pm from 2025-10-10 before 2026-08-24
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched