Summary

Requests for a suborganization's dist archives sent to a subdomain of the repository host name, such as a vendor customer's repository host, looked up the archive in the storage of the main organization. If the suborganization had its own package with the same name as a main organization package, a suborganization member who knew the commit reference of a version of the main organization's package could have downloaded its cached archive this way.

Who was affected

Organizations with suborganizations on Private Packagist Cloud until the fix on October 20, 2026, and on Private Packagist Self-Hosted installations running a version before 2.0.38, if all of the following are true:

• The suborganization has its own package with the same name as a package of the main organization.
• The main organization has a cached archive of a version of that package.

To exploit this, an attacker needed to be a member of the suborganization, or have one of its authentication tokens, with access to the suborganization's package, and had to know the commit reference of the main organization's version.

On Private Packagist Self-Hosted, requests to a subdomain of the repository host name also have to reach the installation, for example through a load balancer that forwards all host names. The ingress included in KOTS installations only forwards the configured host names.

Packages that the main organization added to the suborganization were not affected, as their archives contain the same code the suborganization members already have access to.

Impact

A malicious suborganization member could have downloaded the code of a version of a main organization package they had no access to, if the suborganization had its own package with the same name and the member knew the commit reference of that version.

This issue did not give access to packages without a cached archive, to other packages of the main organization, or to other organizations, and did not allow changing any data.

What we did

Suborganization repositories are now only available on the repository host name. Requests for a suborganization's repository through subdomains of it, including vendor customer host names and custom vendor domains, are rejected. In addition, dist archives of a suborganization are only read from the suborganization's own storage. The fix was deployed on Private Packagist Cloud on October 20, 2026, and released in Private Packagist Self-Hosted 2.0.38.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.38 or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.

All security advisories