The PUT /api/v2/users/{user}/password endpoint in Coder authorized only ActionUpdatePersonal and did not restrict 'user-admin' role users from resetting passwords of 'owner' accounts. Additionally, it did not require the current password when an admin reset another user's password. This flaw allowed a 'user-admin' to escalate privileges by resetting an owner's password, authenticating as that owner, and gaining full control over deployment resources and settings. The vulnerability was addressed by preventing non-owner users from resetting passwords of accounts with the 'owner' role. Patches were backported to all supported release lines, including versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17.

Exploitation allows a user with 'user-admin' privileges to reset the password of an 'owner' account without knowing the current password, effectively escalating their privileges to 'owner'. This grants full control over deployment features such as templates, workspaces, licensing, organization settings, and the ability to self-assign the 'owner' role. The impact is a high-severity privilege escalation within the affected Coder deployments.

Apply the official patches available in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 or later to prevent non-owner users from resetting owner account passwords. Until upgrading, restrict the 'user-admin' role to only trusted administrators to reduce the risk of exploitation.