V2: Coder: User-admin role can reset owner account password (CVE-2026-55077)
### Summary The `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. > **Note:** Exploitation requires the privileged `user-admin` role so practical risk is limited to deployments that grant `user-admin` to less trusted operators. ### Impact A `user-admin` could reset any owner's password without knowing it, authenticate as that owner and gain full deployment control, including templates, workspaces, licensing, organization settings and the ability to self-assign the `owner` role. This was a privilege escalation from `user-admin` to `owner`. ### Patches The fix prevents non-owner users from resetting the password of an account that holds the `owner` role. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict the `user-admin` role to trusted administrators until upgrading. ### Resources - Fix: #25709 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22436) for independently disclosing this issue!
AI Analysis
Technical Summary
The PUT /api/v2/users/{user}/password endpoint in Coder authorized only ActionUpdatePersonal and did not restrict 'user-admin' role users from resetting passwords of 'owner' accounts. Additionally, it did not require the current password when an admin reset another user's password. This flaw allowed a 'user-admin' to escalate privileges by resetting an owner's password, authenticating as that owner, and gaining full control over deployment resources and settings. The vulnerability was addressed by preventing non-owner users from resetting passwords of accounts with the 'owner' role. Patches were backported to all supported release lines, including versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17.
Potential Impact
Exploitation allows a user with 'user-admin' privileges to reset the password of an 'owner' account without knowing the current password, effectively escalating their privileges to 'owner'. This grants full control over deployment features such as templates, workspaces, licensing, organization settings, and the ability to self-assign the 'owner' role. The impact is a high-severity privilege escalation within the affected Coder deployments.
Mitigation Recommendations
Apply the official patches available in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 or later to prevent non-owner users from resetting owner account passwords. Until upgrading, restrict the 'user-admin' role to only trusted administrators to reduce the risk of exploitation.
V2: Coder: User-admin role can reset owner account password (CVE-2026-55077)
Description
### Summary The `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. > **Note:** Exploitation requires the privileged `user-admin` role so practical risk is limited to deployments that grant `user-admin` to less trusted operators. ### Impact A `user-admin` could reset any owner's password without knowing it, authenticate as that owner and gain full deployment control, including templates, workspaces, licensing, organization settings and the ability to self-assign the `owner` role. This was a privilege escalation from `user-admin` to `owner`. ### Patches The fix prevents non-owner users from resetting the password of an account that holds the `owner` role. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict the `user-admin` role to trusted administrators until upgrading. ### Resources - Fix: #25709 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22436) for independently disclosing this issue!
CVSS v3.1
Score 7.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The PUT /api/v2/users/{user}/password endpoint in Coder authorized only ActionUpdatePersonal and did not restrict 'user-admin' role users from resetting passwords of 'owner' accounts. Additionally, it did not require the current password when an admin reset another user's password. This flaw allowed a 'user-admin' to escalate privileges by resetting an owner's password, authenticating as that owner, and gaining full control over deployment resources and settings. The vulnerability was addressed by preventing non-owner users from resetting passwords of accounts with the 'owner' role. Patches were backported to all supported release lines, including versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17.
Potential Impact
Exploitation allows a user with 'user-admin' privileges to reset the password of an 'owner' account without knowing the current password, effectively escalating their privileges to 'owner'. This grants full control over deployment features such as templates, workspaces, licensing, organization settings, and the ability to self-assign the 'owner' role. The impact is a high-severity privilege escalation within the affected Coder deployments.
Mitigation Recommendations
Apply the official patches available in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 or later to prevent non-owner users from resetting owner account passwords. Until upgrading, restrict the 'user-admin' role to only trusted administrators to reduce the risk of exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-29xf-69gq-m9jx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55077"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4c340527e9c797195f647d
Added to database: 07/06/2026, 23:02:29 UTC
Last enriched: 07/06/2026, 23:13:25 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.