hex.pm CVE-2026-75542

Exploitation requires a valid hex.pm API key that carries the repositories permission domain; this key may belong to a personal user account or an organization account. The attacker must additionally know or be able to enumerate the target organization's name on hex.pm (organization names are generally not secret and may be discovered from public package metadata or hex.pm's public API). No non-default server configuration is required - the flaw exists in the standard OAuth client_credentials flow for any hex.pm instance running the vulnerable code. Limiting factors are the PR:L requirement (a pre-existing authenticated API key is mandatory) and the read-only nature of the impact (VI:N, VA:N) - the attacker cannot modify or delete packages, only read private ones. The vulnerability does not affect users or organizations that do not host private packages, as there is nothing confidential to access.

The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately reflects the core threat posture: network-reachable, low complexity, requiring only a valid repositories-scoped API key, with high confidentiality impact extending across organizational boundaries. No EPSS score was included in the intelligence package, so exploitation probability cannot be quantified numerically; however, the attack is mechanically trivial - a single modified OAuth request - and the advisory plus patch diff together constitute a near-complete exploitation recipe, so real-world exploitation likelihood post-disclosure should be treated as elevated. There is no CISA KEV listing and no reported POC code, meaning this is not confirmed actively exploited. The impact is strictly read-only (VI:N, VA:N), limiting blast radius to confidentiality of private package contents rather than infrastructure compromise. The SC:H rating is justified: the exploiting principal crosses into a completely separate organizational trust domain. Real-world risk is meaningful for any organization hosting private packages on hex.pm, particularly those with sensitive intellectual property or internal tooling distributed through the registry.

An attacker holding a hex.pm API key with the repositories permission - obtained via a compromised CI/CD secret, a malicious insider, or a leaked credential - sends a POST to /api/oauth/token with grant_type=client_credentials and scope=repository:<target_org> naming an organization they have no membership in. The unpatched endpoint mints a valid token embedding that scope, which the attacker then presents to hex.pm's CDN edges to download the target organization's private packages without further authentication checks.