CVE-2026-111930 in Coder
Summary
by MITRE • 10/17/2026
Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Coder versions prior to 2.34.8 represents a critical authorization bypass within the application's API layer, specifically affecting the GET /api/v2/workspaces/{id}/acl endpoint. This flaw stems from an insufficient access control mechanism where the system fails to enforce proper privilege separation between workspace-level permissions and group management operations. While the initial check correctly verifies that the authenticated user possesses read or use access rights for a specific workspace, it erroneously proceeds to execute subsequent logic using elevated system privileges rather than maintaining the context of the requesting user's limited scope. This architectural oversight allows any authenticated user with basic workspace access to perform actions that should be restricted to administrators or users with explicit group management permissions.
The technical consequence of this flaw is the unauthorized disclosure of sensitive organizational data through information leakage. By exploiting the elevated system context, an attacker can query the endpoint to retrieve detailed membership information for groups associated with the accessible workspace. The harvested data includes personally identifiable information such as email addresses and login types, alongside operational metadata like user status, last-seen timestamps, and account creation dates. This level of detail provides a comprehensive view of the organization's internal structure and active personnel, which can be leveraged by threat actors for further reconnaissance activities or targeted social engineering attacks.
From an industry standard perspective, this vulnerability aligns with CWE-269, Improper Privilege Management, as it involves executing actions without proper elevation controls. It also corresponds to CWE-862, Missing Authorization, because the application does not properly verify that the user has permission for all aspects of the requested operation, only checking a subset of permissions before proceeding. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1087.004, Account Discovery: Cloud Accounts, as it facilitates the enumeration of active accounts within a cloud-based or web application environment. The ability to harvest email addresses and login types also supports ATT&CK tactic TA0006, Credential Access, by providing intelligence that can aid in phishing campaigns or credential stuffing attacks against specific individuals identified through this data leak.
The operational impact extends beyond simple privacy violations; it significantly increases the attack surface for subsequent compromise attempts. Attackers can use the harvested email addresses and login types to craft highly personalized spear-phishing messages, increasing the likelihood of successful social engineering. Furthermore, knowledge of user status and last-seen timestamps allows adversaries to identify active users during business hours or determine when security teams are likely online versus offline, enabling more effective timing for subsequent attacks such as brute-force attempts or session hijacking if other vulnerabilities exist in the authentication flow.
Mitigation strategies must prioritize immediate patching and access control hardening. The primary remediation is to upgrade Coder to version 2.34.8 or later, where this authorization logic has been corrected to ensure that group member queries are performed within the context of the requesting user's actual permissions rather than an elevated system context. In addition to upgrading, organizations should implement strict input validation and enforce principle of least privilege across all API endpoints. Security teams should also audit existing access control lists to ensure that workspace-level permissions do not inadvertently grant broader administrative capabilities over associated resources like groups or users. Regular penetration testing focused on broken object level authorization (BOLA) patterns is recommended to detect similar flaws in other parts of the application before they can be exploited by malicious actors.