CVE-2026-111930: medium-severity vulnerability in coder
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
coder · coderRelated CVEs — coder
In the same product, most dangerous first.
CVE-2026-44454HIGHCoder vulnerable to workspace auto-creation via crafted URL parameters without user consentEPSS 2.6%CVE-2024-27918HIGHCoder's OIDC authentication allows email with partially matching domain to registerEPSS 1.0%CVE-2026-63443HIGHCoder: Workspace agent API insecure redirect handling allowed cross-agent file read and writeEPSS 0.8%CVE-2026-55077HIGHCoder: User-admin role can reset owner account passwordEPSS 0.6%CVE-2026-55079MEDIUMCoder's unbounded memory allocation in provisioner file upload allows authenticated denial of serviceEPSS 0.6%CVE-2026-55076HIGHCoder's OIDC email_verified type coercion bypass enables account takeover via unverified email linkingEPSS 0.6%