CVE-2026-111930: Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with workspace use access to a workspace can exploit the affected ACL endpoint. The endpoint requires only workspace read access before retrieving group membership data with elevated system context.
What information can be exposed?
An attacker can harvest group members' email addresses, login types, account status, and last-seen and creation timestamps.
Which versions are affected and what version fixes it?
Coder versions from 2.26.0 up to, but not including, 2.34.8 are affected. Upgrade to 2.34.8 or later.