CVE-2026-27968

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Improper Authentication pada packistryphp packistry. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() verified token presence and ability, but did not enforce token expiration. As a result, an expired deploy token with the correct ability could still access repository endpoints (e.g., Composer metadata/download APIs). The fix in version 0.13.0 adds an explicit expiration check, and tests now test expired deploy tokens to ensure they are rejected.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/packistry/packistry/security/advisories/GHSA-4r9m-jp53-vgmw patch · advisory vendor
• https://github.com/packistry/packistry/commit/7740b48f0f4ecbe63099fb056c8a146180f8b283 patch
• https://github.com/packistry/packistry/pull/276 issue tracking · patch