Live › vulnerability › CVE-2026-111928
Go to dashboardCoder versions from 2.0.0 before 2.34.8 do not check organization membership for per-user access entries, and removing a member does not clear those entries. A former member who was granted access keeps reading org-scoped templates and workspaces through the API.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Coder with multiple organizations and per-user ACL grants on templates or workspaces. Deployments with a single organization or without per-user ACL grants are unlikely to be exposed.
No product ranges from the sources yet.
coder version and compare against 2.34.82.34.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
This page as .md · .json · in your agent: get_signal("CVE-2026-111928")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.