Live › vulnerability › CVE-2026-111930
Go to dashboardCoder's GET /api/v2/workspaces/{id}/acl endpoint checks only workspace read access, then returns group member data using an elevated system context. An authenticated user with workspace use access can harvest members' emails, login types, status and timestamps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Coder deployments running versions from before . The exposure needs an authenticated account that has been granted workspace use access, so teams that limit workspace access to trusted users have less exposure. unknown whether the sources list other affected products or configurations.
2.26.02.34.8No product ranges from the sources yet.
coder version, and confirm whether it is at or above 2.34.8.2.26.0 up to but not including 2.34.8.2.34.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.
This page as .md · .json · in your agent: get_signal("CVE-2026-111930")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.