A user who has been removed from an organization can continue to read that organization’s private packages by repeatedly refreshing an OAuth token. The vulnerability lies in the token refresh grant not re‑checking membership status; the grant merely re‑derives a new access token from expanded scopes that were originally granted. This flaw allows an otherwise revoked member to maintain read access indefinitely while a valid refresh token persists, effectively providing unauthorized access to private data.

The issue affects the Hex.pm package registry, specifically releases from 2025‑10‑10 up to before 2026‑08‑24. All installations of hexpm running within that version window are vulnerable; newer releases past 2026‑08‑24 are not impacted.

The CVSS score of 2.3 reflects low severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Attackers would need a valid refresh token for the removed account, which they could obtain if they have lingering access or intercept token traffic. The 30‑day lifetime of the refresh token limits the window but still permits prolonged unauthorised data exposure. Because the flaw does not enable code execution, impact is confined to data confidentiality but can aid an adversary in gathering sensitive package artefacts.