{"id":"CVE-2026-111928","kind":"vulnerability","aliases":["CVE-2026-111928"],"related":[],"title":"Coder: removed organization members keep access to org resources","description":"Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.","summary":"Coder versions from 2.0.0 before 2.34.8 do not check organization membership for per-user access entries, and removing a member does not clear those entries. A former member who was granted access keeps reading org-scoped templates and workspaces through the API.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","multi-tenant","other","self-hosted"],"not_affected_if":["default-config","single-organization"],"how_to_check":"- Run `coder version` and compare against `2.34.8`\n- Review per-user ACL grants on templates and workspaces for users no longer in the organization","fix":"- Upgrade Coder to `2.34.8` or later\n- Review and remove stale per-user ACL entries for former organization members","status":"open","published_at":"2026-10-17T19:16:35+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:16:55+00:00","updated_at":"2026-10-25T04:16:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:16:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.34.8` or later\n- Review and remove stale per-user ACL entries for former organization members","reach":"network","title":"Coder: removed organization members keep access to org resources","impact":"medium","summary":"Coder versions from 2.0.0 before 2.34.8 do not check organization membership for per-user access entries, and removing a member does not clear those entries. A former member who was granted access keeps reading org-scoped templates and workspaces through the API.","category":"other","nicknames":[],"who_cares":["coder","self-hosted","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"former members read org templates and workspaces via API","analyst_note":"","how_to_check":"- Run `coder version` and compare against `2.34.8`\n- Review per-user ACL grants on templates and workspaces for users no longer in the organization","needs_analyst":false,"not_affected_if":["single-organization","default-config"],"who_is_affected":"Teams running self-hosted Coder with multiple organizations and per-user ACL grants on templates or workspaces. Deployments with a single organization or without per-user ACL grants are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000559,"input_tokens":3359,"output_tokens":447,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111928':12A,15A '-2026':11A,14A '2.0.0':27B,70C '2.34.8':29B,72C 'access':6A,39B,56B,114C 'acl':80C,95C 'allow':81C 'api':67B,128C 'authent':106C 'author':76C 'check':32B 'clear':47B 'coder':1A,16B,24B,68C 'coderd/rbac/policy.rego':84C 'contain':73C 'cve':10A,13A 'entri':40B,49B,96C,105C 'former':51B 'grant':55B,116C 'host':23B 'incorrect':75C 'keep':5A,57B,113C 'member':4A,44B,52B,99C 'membership':34B,90C 'multi':18B 'multi-ten':17B 'org':8A,60B,118C 'org-scop':59B,117C 'organ':3A,33B,89C,98C,111C 'per':37B,93C 'per-us':36B,92C 'previous':115C 'read':58B 'remov':2A,42B,100C,108C 'resourc':9A,120C 'rule':82C 'scope':61B,119C 'scrub':103C 'self':22B 'self-host':21B 'templat':62B,123C 'tenant':19B 'user':38B,94C,107C 'verifi':88C 'version':25B 'via':126C 'vulner':77C 'workspac':64B,125C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Coder with multiple organizations and per-user ACL grants on templates or workspaces. Deployments with a single organization or without per-user ACL grants are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111928","severity":null,"published_at":"2026-10-17T19:16:35+00:00","modified_at":"2026-10-19T21:02:21+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}