Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows… (CVE-2026-111929)

Coder versions >=2.30.0 and <2.34.8 contain an authorization bypass vulnerability (CWE-863) in the provisioner daemon's DownloadFile gRPC handler. Authenticated provisioner daemons possessing an org-scoped provisioner key and a known file UUID can exploit this flaw to retrieve cached Terraform module archives from other organizations. This unauthorized access can lead to disclosure of infrastructure topology and embedded secrets. The CVSS 3.1 base score is 5.3, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact.

An attacker with an organization-scoped provisioner key and knowledge of a file UUID can bypass authorization controls to download cached Terraform module archives from other organizations. This results in unauthorized disclosure of potentially sensitive infrastructure configuration and secrets, which could aid further attacks or reconnaissance. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to provisioner daemon keys and monitor for unauthorized access attempts involving file UUIDs. Avoid sharing or exposing file UUIDs externally.