Packistry allows an attacker to use an expired deploy token to access repository endpoints such as metadata and download APIs because token expiration is not checked. This weakness enables unauthorized read access to artifacts that the token is intended to expose, exposing package contents and potentially facilitating further exploitation if the token has elevated privileges. The vulnerability is classified as an improper authentication failure, represented by CWE-287 and CWE-613.

The issue is present in all releases of Packistry prior to version 0.13.0. Any installation running an older build that accepts deploy tokens may be affected.

The CVSS v3 score of 4.3 indicates moderate severity; the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. Packistry is not listed in the CISA KEV catalog. Attackers must obtain or generate an expired deploy token and then send requests to repository endpoints. The attack is feasible over the network and requires only the presence of an expired token, which can be acquired through social engineering, password reuse, or token theft. Once the token is in possession, the attacker can retrieve metadata and download package data without restriction.