---
id: "CVE-2026-111930"
kind: "vulnerability"
aliases: ["CVE-2026-111930"]
title: "Coder: workspace ACL endpoint leaks group members' emails and login details"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "coder", "self-hosted"]
not_affected_if: ["version-2.34.8-or-later"]
published_at: "2026-10-17T19:16:35+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:26:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111930", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: workspace ACL endpoint leaks group members' emails and login details

Coder's GET /api/v2/workspaces/{id}/acl endpoint checks only workspace read access, then returns group member data using an elevated system context. An authenticated user with workspace use access can harvest members' emails, login types, status and timestamps.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Coder version with `coder version`, and confirm whether it is at or above `2.34.8`.
- Confirm whether the deployment is on a version from `2.26.0` up to but not including `2.34.8`.

## Fix

- Upgrade Coder to `2.34.8` or later.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111930

## From the sources

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_