Authorization Flaw in Coder Affecting Workspace Access Control

CVE-2026-111930

What is CVE-2026-111930?

Coder versions from 2.26.0 to earlier than 2.34.8 exhibit an authorization issue within the GET /api/v2/workspaces/{id}/acl endpoint. This flaw improperly assesses user permissions, granting authenticated users with workspace use access the ability to retrieve sensitive information, including the emails, login types, status, and timestamps of group members. Such vulnerabilities expose personal data without adequate permission checks, raising concerns over data privacy and security within the application.

References