Summary

In organizations that synchronize their teams and members with a code hosting platform, a member removed on the Members page lost access to the organization but kept the access their teams had in the organization's suborganizations until the next synchronization run, by default within 20 hours.

Who was affected

Organizations on Private Packagist Cloud until the fix on October 19, 2026, and on Private Packagist Self-Hosted installations running a version before 2.0.38, if all of the following are true:

• The organization synchronizes its teams and members with a code hosting platform.
• The organization uses suborganizations, and at least one of its teams has access to a suborganization.
• An owner or admin removed a member of that team on the Members page, which lists the member under Removed Synchronized Members.

A removed member kept the suborganization access until the next synchronization run, which runs at least once every 20 hours by default, or until the next change of team members in the organization, whichever came first.

Organizations that do not synchronize members were not affected: removing a member there removed the member from the suborganization teams right away.

Impact

A removed member could have kept using the suborganizations their teams had access to until the next synchronization run, by default within 20 hours. They kept the same access as before the removal: viewing and installing the suborganization's packages with their own Composer authentication token, and, if the team had admin access to a suborganization, managing that suborganization.

The removed member could not access the main organization, could not gain more access than their teams had before the removal, and could not access suborganizations their teams had no access to.

What we did

Removing a synchronized member on the Members page now also removes the member from their teams in the suborganizations right away. The fix was deployed on Private Packagist Cloud on October 19, 2026, and released in Private Packagist Self-Hosted 2.0.38.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.38 or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.

All security advisories