{"id":"CVE-2026-111930","kind":"vulnerability","aliases":["CVE-2026-111930"],"related":[],"title":"Coder: workspace ACL endpoint leaks group members' emails and login details","description":"Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.","summary":"Coder's GET /api/v2/workspaces/{id}/acl endpoint checks only workspace read access, then returns group member data using an elevated system context. An authenticated user with workspace use access can harvest members' emails, login types, status and timestamps.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","coder","self-hosted"],"not_affected_if":["version-2.34.8-or-later"],"how_to_check":"- Check the installed Coder version with `coder version`, and confirm whether it is at or above `2.34.8`.\n- Confirm whether the deployment is on a version from `2.26.0` up to but not including `2.34.8`.","fix":"- Upgrade Coder to `2.34.8` or later.","status":"open","published_at":"2026-10-17T19:16:35+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:48+00:00","updated_at":"2026-10-25T04:26:48+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:26:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.34.8` or later.","reach":"network","title":"Coder: workspace ACL endpoint leaks group members' emails and login details","impact":"low","summary":"Coder's GET /api/v2/workspaces/{id}/acl endpoint checks only workspace read access, then returns group member data using an elevated system context. An authenticated user with workspace use access can harvest members' emails, login types, status and timestamps.","category":"ai-tooling","nicknames":[],"who_cares":["coder","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated users harvest group members' emails and login details.","analyst_note":"","how_to_check":"- Check the installed Coder version with `coder version`, and confirm whether it is at or above `2.34.8`.\n- Confirm whether the deployment is on a version from `2.26.0` up to but not including `2.34.8`.","needs_analyst":false,"not_affected_if":["version-2.34.8-or-later"],"who_is_affected":"Coder deployments running versions from `2.26.0` before `2.34.8`. The exposure needs an authenticated account that has been granted workspace use access, so teams that limit workspace access to trusted users have less exposure. unknown whether the sources list other affected products or configurations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000581,"input_tokens":3364,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111930':14A,17A '-2026':13A,16A '/acl':30B,78C '/api/v2/workspaces':28B,76C '2.26.0':65C '2.34.8':67C 'access':36B,53B,85C,101C 'acl':3A 'ai':19B 'ai-tool':18B 'authent':48B,96C 'author':71C 'check':32B,81C 'coder':1A,21B,25B,63C 'contain':68C 'context':46B,95C 'creation':119C 'cve':12A,15A 'data':41B 'detail':11A 'elev':44B,93C 'email':8A,57B,110C 'endpoint':4A,31B,79C,105C 'fetch':88C 'flaw':72C 'get':27B,75C 'grant':98C 'group':6A,39B,89C,108C 'harvest':55B,107C 'host':24B 'id':29B,77C 'incorrect':70C 'last':116C 'last-seen':115C 'leak':5A 'login':10A,58B,111C 'member':7A,40B,56B,90C,109C 'queri':103C 'read':35B,84C 'return':38B 'seen':117C 'self':23B 'self-host':22B 'status':60B,113C 'system':45B,94C 'timestamp':62B,120C 'tool':20B 'type':59B,112C 'use':42B,52B,91C,100C 'user':49B,97C 'workspac':2A,34B,51B,83C,99C","nicknames":[],"mitigations":[],"who_affected":"Coder deployments running versions from `2.26.0` before `2.34.8`. The exposure needs an authenticated account that has been granted workspace use access, so teams that limit workspace access to trusted users have less exposure. unknown whether the sources list other affected products or configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111930","severity":null,"published_at":"2026-10-17T19:16:35+00:00","modified_at":"2026-10-19T22:17:05+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}