Summary

A malicious suborganization admin without access to the main organization could have changed the destination of a notification channel that the main organization shared with their suborganization, if they were an admin of every suborganization the channel was shared with. The main organization's notifications sent to that channel would then have gone to a destination of the attacker's choice.

Who was affected

Organizations on Private Packagist Cloud until the fix on October 16, 2026, and on Private Packagist Self-Hosted installations running a version before 2.0.38, if all of the following are true:

• The organization uses suborganizations.
• The main organization shared a notification channel with one or more suborganizations, and sends its own notifications to that channel.
• A malicious user is an admin of every suborganization the channel is shared with, but does not have admin access to the main organization.

Collaborators of a suborganization could not change the channel.

Impact

A malicious suborganization admin could have changed the type, name, webhook URL and secret, Slack settings or email recipients of the notification channel from their suborganization. From then on, the notifications the main organization sends to that channel would have gone to a destination of the attacker's choice instead of the configured one. Depending on the channel's settings, these could have included:

• security notifications for the main organization's packages, with the package name, affected versions, advisory details and repository URL
• release notifications for new package versions
• notifications about abandoned packages
• errors when publishing packages

The main organization would have stopped receiving these notifications at its original destination.

The malicious suborganization admin could not change which notifications the main organization sends to the channel, could not access package code or credentials, and could not see data of other organizations. Changes to the channel made since May 2023 were recorded in the main organization's audit log.

What we did

From a suborganization, the destination of a notification channel the main organization sends its own notifications to can now only be changed by owners and admins of the main organization. Suborganization admins can still change which notifications their suborganization sends to the channel. The fix was deployed on Private Packagist Cloud on October 16, 2026, and released in Private Packagist Self-Hosted 2.0.38. We found this vulnerability during an internal security review.

We reviewed the audit log entries of changes to notification channels on Private Packagist Cloud since May 2023, when we started recording them, and found no destination change made by a suborganization admin without access to the main organization. To the best of our knowledge, this vulnerability was not exploited on Private Packagist Cloud.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.38 or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required to prevent this from now on.
• Private Packagist Self-Hosted, and Cloud organizations that shared notification channels with suborganizations before May 2023: to check for past changes, open Settings > Notification channels in the main organization and verify the destination of each channel shared with suborganizations. For changes made since May 2023, the main organization's audit log shows who changed each channel. If a channel's destination was changed, restore its original type and destination. For a webhook channel, also set a new secret, as a malicious suborganization admin could have set the current one.

All security advisories