Vulnerability-Lookup

CVE-2026-75554 (GCVE-0-2026-75554)

Vulnerability from cvelistv5 – Published: 2026-08-24 20:15 – Updated: 2026-08-24 20:15

Title

Explicit organization scopes survive token refresh after membership ends

Summary

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime. This issue affects hex.pm: from 2025-10-10 before 2026-08-24.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

CWE

CWE-613 - Insufficient Session Expiration

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/hexpm/hexpm/security/advisorie…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-75554.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-75554	related
https://github.com/hexpm/hexpm/commit/50cffd20649…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
hexpm	hexpm	Affected: 2025-10-10 , < 2026-08-24 (date) cpe:2.3:a:hexpm:hexpm::::::::
hexpm	hexpm	Affected: 650faa03af511e74c1b3b49ec12d35666b6984c4 , < 50cffd206490c49c92d7b63c8505949682abedb0 (git) cpe:2.3:a:hexpm:hexpm::::::::

Credits

Eric Meadows-Jönsson Eric Meadows-Jönsson Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hex.pm",
          "cpes": [
            "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Hexpm.Permissions\u0027",
            "\u0027Elixir.Hexpm.OAuth.Tokens\u0027",
            "\u0027Elixir.HexpmWeb.API.OAuthController\u0027"
          ],
          "packageName": "hex.pm",
          "product": "hexpm",
          "programFiles": [
            "lib/hexpm/permissions.ex",
            "lib/hexpm/oauth/tokens.ex",
            "lib/hexpm_web/controllers/api/oauth_controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2"
            },
            {
              "name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6"
            },
            {
              "name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2"
            }
          ],
          "vendor": "hexpm",
          "versions": [
            {
              "lessThan": "2026-08-24",
              "status": "affected",
              "version": "2025-10-10",
              "versionType": "date"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Hexpm.Permissions\u0027",
            "\u0027Elixir.Hexpm.OAuth.Tokens\u0027",
            "\u0027Elixir.HexpmWeb.API.OAuthController\u0027"
          ],
          "packageName": "hexpm/hexpm",
          "packageURL": "pkg:github/hexpm/hexpm",
          "product": "hexpm",
          "programFiles": [
            "lib/hexpm/permissions.ex",
            "lib/hexpm/oauth/tokens.ex",
            "lib/hexpm_web/controllers/api/oauth_controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2"
            },
            {
              "name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6"
            },
            {
              "name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2"
            }
          ],
          "repo": "https://github.com/hexpm/hexpm",
          "vendor": "hexpm",
          "versions": [
            {
              "lessThan": "50cffd206490c49c92d7b63c8505949682abedb0",
              "status": "affected",
              "version": "650faa03af511e74c1b3b49ec12d35666b6984c4",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eric Meadows-J\u00f6nsson"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Eric Meadows-J\u00f6nsson"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eexpand_repositories_scope/3\u003c/code\u003e in \u003ccode\u003elib/hexpm/permissions.ex\u003c/code\u003e only rewrites the literal \u003ccode\u003erepositories\u003c/code\u003e scope, so an explicitly granted \u003ccode\u003erepository:\u0026lt;org\u0026gt;\u003c/code\u003e or \u003ccode\u003edocs:\u0026lt;org\u0026gt;\u003c/code\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored \u003ccode\u003egranted_scopes\u003c/code\u003e, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\u003c/p\u003e\n\u003cp\u003eThis issue affects hex.pm: from 2025-10-10 before 2026-08-24.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\n\n`expand_repositories_scope/3` in `lib/hexpm/permissions.ex` only rewrites the literal `repositories` scope, so an explicitly granted `repository:\u003corg\u003e` or `docs:\u003corg\u003e` scope passes through it untouched. The refresh grant re-derives a new token from the stored `granted_scopes`, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\n\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24."
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\n\nexpand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:\u003corg\u003e or docs:\u003corg\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\n\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-24T20:15:05.791Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-75554.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-75554"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Explicit organization scopes survive token refresh after membership ends"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-75554",
    "datePublished": "2026-08-24T20:15:05.791Z",
    "dateReserved": "2026-08-18T06:00:02.163Z",
    "dateUpdated": "2026-08-24T20:15:05.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-75554\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-08-24T21:17:47.557\",\"lastModified\":\"2026-08-24T21:17:47.557\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\\n\\nexpand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:\u003corg\u003e or docs:\u003corg\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\\n\\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"hexpm\",\"product\":\"hexpm\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://hex.pm\",\"packageName\":\"hex.pm\",\"cpes\":[\"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Hexpm.Permissions\u0027\",\"\u0027Elixir.Hexpm.OAuth.Tokens\u0027\",\"\u0027Elixir.HexpmWeb.API.OAuthController\u0027\"],\"programFiles\":[\"lib/hexpm/permissions.ex\",\"lib/hexpm/oauth/tokens.ex\",\"lib/hexpm_web/controllers/api/oauth_controller.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2\"},{\"name\":\"\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6\"},{\"name\":\"\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2\"}],\"versions\":[{\"version\":\"2025-10-10\",\"lessThan\":\"2026-08-24\",\"versionType\":\"date\",\"status\":\"affected\"}]},{\"vendor\":\"hexpm\",\"product\":\"hexpm\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"hexpm/hexpm\",\"cpes\":[\"cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Hexpm.Permissions\u0027\",\"\u0027Elixir.Hexpm.OAuth.Tokens\u0027\",\"\u0027Elixir.HexpmWeb.API.OAuthController\u0027\"],\"programFiles\":[\"lib/hexpm/permissions.ex\",\"lib/hexpm/oauth/tokens.ex\",\"lib/hexpm_web/controllers/api/oauth_controller.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2\"},{\"name\":\"\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6\"},{\"name\":\"\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2\"}],\"repo\":\"https://github.com/hexpm/hexpm\",\"packageURL\":\"pkg:github/hexpm/hexpm\",\"versions\":[{\"version\":\"650faa03af511e74c1b3b49ec12d35666b6984c4\",\"lessThan\":\"50cffd206490c49c92d7b63c8505949682abedb0\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-75554.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-75554\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}"
  }
}

FKIE_CVE-2026-75554

Vulnerability from fkie_nvd - Published: 2026-08-24 21:17 - Updated: 2026-08-24 21:17

Severity

2.3 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-75554.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-75554

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://hex.pm",
          "cpes": [
            "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Hexpm.Permissions\u0027",
            "\u0027Elixir.Hexpm.OAuth.Tokens\u0027",
            "\u0027Elixir.HexpmWeb.API.OAuthController\u0027"
          ],
          "packageName": "hex.pm",
          "product": "hexpm",
          "programFiles": [
            "lib/hexpm/permissions.ex",
            "lib/hexpm/oauth/tokens.ex",
            "lib/hexpm_web/controllers/api/oauth_controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2"
            },
            {
              "name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6"
            },
            {
              "name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2"
            }
          ],
          "vendor": "hexpm",
          "versions": [
            {
              "lessThan": "2026-08-24",
              "status": "affected",
              "version": "2025-10-10",
              "versionType": "date"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Hexpm.Permissions\u0027",
            "\u0027Elixir.Hexpm.OAuth.Tokens\u0027",
            "\u0027Elixir.HexpmWeb.API.OAuthController\u0027"
          ],
          "packageName": "hexpm/hexpm",
          "packageURL": "pkg:github/hexpm/hexpm",
          "product": "hexpm",
          "programFiles": [
            "lib/hexpm/permissions.ex",
            "lib/hexpm/oauth/tokens.ex",
            "lib/hexpm_web/controllers/api/oauth_controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Hexpm.Permissions\u0027:expand_repositories_scope/2"
            },
            {
              "name": "\u0027Elixir.Hexpm.OAuth.Tokens\u0027:create_for_user/6"
            },
            {
              "name": "\u0027Elixir.HexpmWeb.API.OAuthController\u0027:handle_refresh_token_grant/2"
            }
          ],
          "repo": "https://github.com/hexpm/hexpm",
          "vendor": "hexpm",
          "versions": [
            {
              "lessThan": "50cffd206490c49c92d7b63c8505949682abedb0",
              "status": "affected",
              "version": "650faa03af511e74c1b3b49ec12d35666b6984c4",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.\n\nexpand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:\u003corg\u003e or docs:\u003corg\u003e scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.\n\nThis issue affects hex.pm: from 2025-10-10 before 2026-08-24."
    }
  ],
  "id": "CVE-2026-75554",
  "lastModified": "2026-08-24T21:17:47.557",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-24T21:17:47.557",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-75554.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-75554"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-75554 (GCVE-0-2026-75554)

FKIE_CVE-2026-75554

Tags

Sightings

Nomenclature