Vulnerabilities

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not…

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

5.4

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-111928 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 14d ago

   Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally…

   CVSS 4.3 CVE-2026-111931
2. 3
   CVE NVD 14d ago

   Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace…

   CVSS 4.3 CVE-2026-111930
3. 8
   CVE NVD 14d ago

   Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows…

   CVSS 5.3 CVE-2026-111929 HashiCorp