CVE-2026-27968

MEDIUM EPSS 8.2%
Published Feb 26, 20264mo ago · Modified Jun 17, 20262w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Feb 26, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() verified token presence and ability, but did not enforce token expiration. As a result, an expired deploy token with the correct ability could still access repository endpoints (e.g., Composer metadata/download APIs). The fix in version 0.13.0 adds an explicit expiration check, and tests now test expired deploy tokens to ensure they are rejected.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
8.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-287 Improper Authentication Authentication
CWE-613

Affected Products 1

VendorProductVersionRange
packistryphppackistry* <0.13.0

References 3

  • github.com https://github.com/packistry/packistry/commit/7740b48f0f4ecbe63099fb056c8a146180f8b283
    Patch
  • github.com https://github.com/packistry/packistry/pull/276
    Issue TrackingPatch
  • github.com https://github.com/packistry/packistry/security/advisories/GHSA-4r9m-jp53-vgmw
    PatchVendor Advisory

Remediation

  • github.com https://github.com/packistry/packistry/commit/7740b48f0f4ecbe63099fb056c8a146180f8b283
    Patch
  • github.com https://github.com/packistry/packistry/pull/276
    Issue TrackingPatch
  • github.com https://github.com/packistry/packistry/security/advisories/GHSA-4r9m-jp53-vgmw
    PatchVendor Advisory