An incorrect authorization vulnerability in the hexpm OAuth token endpoint allows unauthorized access to private packages, threatening the confidentiality of proprietary code and data.

The issue is an incorrect authorization flaw (CWE-863) where the system fails to properly validate the scope of an API key. An authenticated user holding valid repository permissions can leverage this weakness to read private packages owned by different organizations.

The ability to access another organization's private packages can lead to the exposure of sensitive proprietary information, intellectual property theft, and potential supply chain compromise. With a CVSS score of 8.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update the hexpm instance to the patched version that includes commit bf0fb9d208f0acfabf7a2f7467c8231659e322a8.

Proactive Monitoring: Audit API key usage logs to identify any anomalous access requests or unauthorized attempts to pull private packages from unfamiliar organizations.

Compensating Controls: Temporarily revoke highly privileged API keys until the update is applied, and enforce strict organizational scoping for all API access tokens.

Public Exploit Available: No

Security teams managing hexpm installations must apply the provided patch immediately to close the authorization gap. Ensuring that API keys are restricted to their intended scope is critical to maintaining the security and privacy of the package repository ecosystem.