CVE-2026-111928
CVE-2026-111928 · Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
CVSS 5.3 · Moyenne · EPSS 0,1% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
coder
- Versions du logiciel
- ≥ 2.0.0, < 2.34.8: Concernée (semver)
- 2.34.8: Non concernée (semver)
Mettez à jour vers 2.34.8