Incorrect Authorization in Coder Exposes Group Member Data via ACL Endpoint

Executive Summary

CVE-2026-111930 is an information disclosure vulnerability in Coder versions 2.26.0 to 2.34.7. It involves the GET /api/v2/workspaces/{id}/acl endpoint, which incorrectly checks only workspace read access before fetching group members using an elevated system context. This allows authenticated users with workspace use access to harvest sensitive data like emails, login types, status, and timestamps of group members.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Coder instance is running a vulnerable version (2.26.0 to 2.34.7). Use commands like 'curl -X GET http://<coder-server>/api/v2/workspaces/{id}/acl' with a low-privilege user token to test if group member PII is exposed. Compare responses against expected RBAC restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privilege users to enumerate group membership and collect personally identifiable information (PII) such as emails, login types, and timestamps. Attackers could exploit this data for phishing or reconnaissance purposes, potentially leading to further security breaches or privacy violations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized exposure of personally identifiable information (PII). GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The disclosure of such data without proper authorization could result in regulatory penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coder to version 2.34.8 or later immediately. Restrict workspace access to least privilege. Audit API responses for the /api/v2/workspaces/{id}/acl endpoint to ensure no PII leakage occurs. Monitor for unusual enumeration attempts by low-privilege users.

Useful 0 Not Useful 0