PyPI Access Control Vulns Patched

What it is

Socket.dev's writeup of Trail of Bits' second Warehouse (PyPI) security audit, Feb 23–Mar 20 2026, funded by the Sovereign Tech Agency. Two consultants over six engineer-weeks produced 14 findings: 2 High, 1 Medium, 7 Low, 4 Informational. All but two are remediated. The value beyond the catalog summary is in the fix mechanics and the transferable detection patterns — this concerns a hosted service, so there is no patch for the reader to apply, but the failure modes recur in any multi-tenant authz/OIDC system.

How it works

The three main flaws are covered in the summary. The engineering lessons worth carrying:

• Read-permission on a state-changing POST. manage_organization_roles served GET and POST under one @view_config requiring only Permissions.OrganizationsRead; the POST created invitations with an attacker-chosen role_name. Fix: split so POST requires OrganizationsManage.
• Cross-organization stale roles. TeamProjectRole referenced project and team independently, with no constraint tying team access to the project's current owning org; ACL evaluation matched all such records without checking org ownership. Records were invisible to the receiving org and absent from the collaborator list.
• Anti-replay key shorter than the JWT leeway. Redis jti key expired at exp + 5, but jwt.decode used leeway=30, leaving a 25-second window where the replay key was gone but the signature still validated.

What to do

The page states no commands for readers. The generalizable actions:

• Adopt Trail of Bits' CodeQL query detecting state-changing POST handlers protected only by read-level permissions — reusable against your own codebase.
• Add defensive ACL filters verifying a team's org matches the resource's current org, not just deleting stale rows (PyPI did both).
• Align anti-replay key TTL with the full JWT leeway window, not exp, whenever jti single-use enforcement backs a leeway-tolerant verifier.

Caveats

Two findings remain unremediated (unnamed). PyPI audited historical records and found no evidence prior transfers left dangling permissions. Subtitle references an API-token-deletion IDOR and audit-logging gaps; the body text cuts off before detailing them.