{"id":"CVE-2026-27968","aliases":["EUVD-2026-8820","GHSA-4r9m-jp53-vgmw"],"status":"published","title":"Packistry accepts expired access tokens","description":"Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() verified token presence and ability, but did not enforce token expiration. As a result, an expired deploy token with the correct ability could still access repository endpoints (e.g., Composer metadata/download APIs). The fix in version 0.13.0 adds an explicit expiration check, and tests now test expired deploy tokens to ensure they are rejected.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00214,"percentile":0.11931,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-613"],"published":"2026-02-26T01:57:12Z","modified":"2026-10-28T02:30:49Z","products":[{"vendor":"packistry","product":"packistry"},{"vendor":"packistryphp","product":"packistry"}],"references":[{"url":"https://github.com/packistry/packistry/security/advisories/GHSA-4r9m-jp53-vgmw","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory"]},{"url":"https://github.com/packistry/packistry/pull/276","tags":["x_refsource_MISC","Issue Tracking","Patch","fix"]},{"url":"https://github.com/packistry/packistry/commit/7740b48f0f4ecbe63099fb056c8a146180f8b283","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27968.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27968","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-27968","title":"Packistry accepts expired access tokens","description":"Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() verified token presence and ability, but did not enforce token expiration. As a result, an expired deploy token with the correct ability could still access repository endpoints (e.g., Composer metadata/download APIs). The fix in version 0.13.0 adds an explicit expiration check, and tests now test expired deploy tokens to ensure they are rejected.","status":"published","published":"2026-02-26T01:57:12.752Z","modified":"2026-02-26T14:53:10.334Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287","CWE-613"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-8820","description":"Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() verified token presence and ability, but did not enforce token expiration. As a result, an expired deploy token with the correct ability could still access repository endpoints (e.g., Composer metadata/download APIs). The fix in version 0.13.0 adds an explicit expiration check, and tests now test expired deploy tokens to ensure they are rejected.","status":"published","published":"2026-02-26T01:57:12Z","modified":"2026-02-26T14:53:10Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:27.038974Z"}],"nvd":[{"id":"CVE-2026-27968","description":"Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() verified token presence and ability, but did not enforce token expiration. As a result, an expired deploy token with the correct ability could still access repository endpoints (e.g., Composer metadata/download APIs). The fix in version 0.13.0 adds an explicit expiration check, and tests now test expired deploy tokens to ensure they are rejected.","status":"published","published":"2026-02-26T02:16:23.99Z","modified":"2026-06-17T10:27:59.38Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287","CWE-613"],"updated_at":"2026-11-02T14:12:07.027269Z"}],"osv":[{"id":"CVE-2026-27968","title":"Packistry accepts expired access tokens","description":"Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() verified token presence and ability, but did not enforce token expiration. As a result, an expired deploy token with the correct ability could still access repository endpoints (e.g., Composer metadata/download APIs). The fix in version 0.13.0 adds an explicit expiration check, and tests now test expired deploy tokens to ensure they are rejected.","status":"published","published":"2026-02-26T01:57:12.752Z","modified":"2026-10-28T02:30:49.24680213Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-287","CWE-613"],"updated_at":"2026-11-02T15:45:00.180685Z"}]}}