CVE-2026-111928: Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the aclallow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coderto a version that resolves this vulnerability.Fixed in 2.34.8
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user who was removed from an organization may still be able to access organization-scoped resources if they had previously been granted access through a per-user ACL entry. Relevant resources include templates and workspaces.
Does removing a user from an organization revoke their previously granted per-user access?
No. Organization member removal does not scrub the affected per-user ACL entries, allowing the removed user to retain API access to resources previously granted through those entries.
What access is required to exploit the vulnerability?
The attacker must be authenticated and must have had a prior per-user ACL grant for an organization-scoped resource. Exploitation is performed through the API and does not require user interaction.
Which Coder versions are affected?
Coder versions from 2.0.0 before 2.34.8 are affected. Version 2.34.8 is not included in the affected range.