CVE-2026-111928 in Coder
Summary
by MITRE • 10/17/2026
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Coder versions prior to 2.34.8 represents a critical failure in access control logic within the application's role-based access management system. Specifically, the flaw resides in the acl_allow rule of the coderd/rbac/policy.rego file, which governs how permissions are evaluated for users interacting with organizational resources. The core technical deficiency is that the authorization mechanism does not adequately verify current organization membership when processing per-user Access Control List entries. This means that once a user is granted specific privileges at an individual level within an organization's scope, those privileges persist in the policy evaluation logic regardless of whether the user remains an active member of that organization.
This architectural oversight leads to a severe authorization bypass scenario where authenticated users who have been explicitly removed from an organization retain access to org-scoped resources. These resources include sensitive assets such as development templates and workspaces, which are accessible via the application's API. The vulnerability is exacerbated by the fact that the process for removing members does not scrub or invalidate these existing per-user ACL entries. Consequently, a user who has been terminated or revoked from an organization can continue to authenticate and execute requests against resources they should no longer have permission to access. This creates a persistent security gap where historical permissions are treated as permanent rather than conditional on current membership status.
From an operational impact perspective, this vulnerability allows for unauthorized data exposure and potential manipulation of organizational assets. Attackers or malicious insiders who retain API credentials after being removed from an organization can exfiltrate code templates, access active workspaces, or disrupt ongoing development activities. The ability to interact with these resources via the API means that automated tools could be used to scrape sensitive configuration details or source code stored within workspaces. This undermines the principle of least privilege and fails to enforce proper offboarding procedures, leaving organizations vulnerable to data breaches even after personnel changes have been processed through standard administrative channels.
This issue aligns with CWE-269, which describes Improper Authorization, specifically where a user retains privileges they should no longer possess due to flawed logic in permission checks. Furthermore, it relates to ATT&CK technique T1078, Valid Accounts, as the attacker utilizes legitimate but now unauthorized credentials to maintain access to systems and data after their account status has been changed by administrators. The failure to scrub ACL entries upon member removal also touches on CWE-693, Protection Mechanism Failure, where a security control fails to perform its intended function of revoking access when conditions change.
To mitigate this vulnerability, organizations must upgrade Coder to version 2.34.8 or later, which contains the corrected authorization logic that properly verifies organization membership for per-user ACL entries and ensures that member removal triggers the scrubbing of associated permissions. Until an upgrade is feasible, administrators should manually audit user access lists within affected instances to identify any lingering ACL entries for users who have been removed from organizations. It is also recommended to enforce strict API key rotation policies so that if a user has left the organization, their active tokens are invalidated immediately upon removal. Implementing automated offboarding workflows that explicitly revoke all associated permissions and invalidate credentials can help prevent similar issues in future deployments of vulnerable versions.