Summary

Update Review could look up packages in the Composer repository of any organization, not only in that of the organization the review ran for, and so show details of another organization's packages in its comments: whether a package existed, links built from its stored source URL and its changelog.

Who was affected

Organizations and suborganizations on Private Packagist Cloud until the fix on October 15, 2026, and on Private Packagist Self-Hosted installations running a version before 2.0.38, if all of the following are true:

• A malicious user can open or update a pull request in a repository for which any organization enabled Update Review.
• The attacker knows the URL name of the targeted organization, as used in its Composer repository URL.
• The attacker manually edits composer.json and composer.lock in the pull request to add guessed package names with the targeted organization's Composer repository URL.

On Private Packagist Self-Hosted, only organizations on the same installation could be targeted.

Impact

For each package name an attacker guessed that existed in the targeted organization, the Update Review comment on the attacker's pull request could have shown:

• That the package exists, and its internal identifier in a link to the package page in the targeted organization, which the attacker could not open.
• Links to the code changes and the release, built from the source URL Private Packagist stores for the package, which can reveal the name and location of a private source repository.
• Whether the package has a changelog, and on the Update Review page in Private Packagist, which members of the reviewing organization can open, the changelog entries between the two versions in the pull request.

The attacker could not list the packages of the targeted organization, download any code or package metadata such as versions or dependencies, or change any data of the targeted organization.

What we did

Update Review now only looks up packages in the Composer repository of the organization the review runs for and of its suborganizations. Packages served from the Composer repository of any other organization are shown like packages from any other source, without links to Private Packagist or information stored for the package. The fix was deployed on Private Packagist Cloud on October 15, 2026, and released in Private Packagist Self-Hosted 2.0.38. We found this vulnerability during an internal security review.

We reviewed all Update Review comments currently stored on Private Packagist Cloud and found none showing packages of another organization. Private Packagist only keeps the latest version of each comment, so earlier versions of a comment, replaced by a later update of the pull request, could not be reviewed. To the best of our knowledge, this vulnerability was not exploited on Private Packagist Cloud.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.38 or any later version. We recommend upgrading to the latest release. Afterwards, run this command to check your installation for Update Review comments that showed packages of an organization other than the one the review ran for and its suborganizations. It prints one line for each such package, with a link to the comment, the reviewing organization and the organization the package belongs to, and otherwise "No Update Review comments found that resolved packages of another organization". Private Packagist only keeps the latest version of each Update Review comment: a later update of the pull request replaces it, and the comment is deleted when the pull request no longer changes a composer.lock file, so the command cannot report earlier versions of a comment. If it reports any match, contact us at contact@packagist.com.

  kubectl exec $(kubectl get pods --field-selector=status.phase=Running --no-headers -o custom-columns=":metadata.name"|grep worker-) -- /bin/sh -c "/srv/manager/bin/console packagist:audit --vulnerability PPSA-202610-9"
  

• Private Packagist Cloud: No action is required.

All security advisories