CVE-2026-27968

CVE-2026-27968 affects Packistry, a self-hosted Composer repository. Before version 0.13.0, RepositoryAwareController::authorize() did not enforce token expiration, allowing an expired deploy token with the correct ability to access repository endpoints (e.g., Composer metadata/download APIs). Th...