Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not… (CVE-2026-111928)

The vulnerability in Coder affects versions from 2.0.0 before 2.34.8. It is caused by an incorrect authorization check in the acl_allow rule within coderd/rbac/policy.rego. Specifically, the rule fails to verify whether a user is still a member of an organization when evaluating per-user ACL entries. Additionally, when a user is removed from an organization, their ACL entries are not scrubbed, allowing continued access to organization-scoped resources such as templates and workspaces through the API. This can lead to unauthorized access by users who should no longer have permissions.

The impact is limited to unauthorized access to organization-scoped resources by users who have been removed from the organization. This could lead to information disclosure or unauthorized use of templates and workspaces. The CVSS score of 5.4 (medium severity) reflects limited confidentiality and integrity impact with no availability impact.

A fix is available in Coder version 2.34.8 and later. Users should upgrade to version 2.34.8 or newer to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the patch. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.