CVE-2026-75554: hexpm 2025-10-10 to before 2026-08-24

Affected technology

hexpm · 2025-10-10 to before 2026-08-24
hexpm

hexpm · 650faa03af511e74c1b3b49ec12d35666b6984c4 to before 50cffd206490c49c92d7b63c8505949682abedb0
hexpm

Component: 'Elixir.Hexpm.Permissions', 'Elixir.Hexpm.OAuth.Tokens', 'Elixir.HexpmWeb.API.OAuthController'
Function: 'Elixir.Hexpm.Permissions':expand_repositories_scope/2, 'Elixir.Hexpm.OAuth.Tokens':create_for_user/6, 'Elixir.HexpmWeb.API.OAuthController':handle_refresh_token_grant/2
File: lib/hexpm/permissions.ex, lib/hexpm/oauth/tokens.ex, lib/hexpm_web/controllers/api/oauth_controller.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.