Summary

The organization log, now called the audit log, could be viewed by every member of an organization instead of only by members with admin access.

Who was affected

Organizations on Private Packagist Cloud until the fix on April 5, 2024, and on Private Packagist Self-Hosted installations running a version before 2.0.3 (KOTS) or 1.12.5 (Replicated Native). Only members of the organization could access the log. It was not accessible to anyone outside the organization.

Impact

Members of an organization without admin access could see the activity recorded in the organization's audit log, such as changes to members, teams, packages, and settings. They could not change anything through the audit log, and it was not accessible to anyone outside the organization.

What we did

The audit log can now only be accessed by members with admin access.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.3 (KOTS) or 1.12.5 (Replicated Native) or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.

Credits

Thanks to Satyam Singh for reporting this issue.

All security advisories