Skip to content

CVE record · 1 source

CVE-2026-111930

CVSS 4.3

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace…

CVSS: 4.3

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

3

CVE NVD 14d ago

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace…

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context.…

CVSS 4.3 CVE-2026-111930