CVE-2026-111928 coder CVE debrief

Who should care

Defenders and administrators of Coder installations should assess exposure and prioritize remediation, especially for users with prior access to organization resources. They should verify Coder version and check if it falls within the affected range (2.0.0 to 2.34.7). They should also review organization membership and access control lists (ACLs) for Coder users, and monitor API access for removed organization members.

Why it matters

CVE-2026-111928 is a medium-severity vulnerability in Coder that allows removed organization members to access previously granted resources. Defenders should verify exposure, prioritize remediation, and monitor for potential unauthorized access.

• Verification of Coder version and organization membership is required to determine exposure.
• Potential for continued access to org-scoped resources by removed users.
• Need for updates to Coder version 2.34.8 or later to address the vulnerability.
• Monitoring of API access for removed organization members to detect potential unauthorized access.

Technical summary

The vulnerability is caused by an incorrect authorization rule in coderd/rbac/policy.rego, which fails to verify organization membership for per-user ACL entries. This allows authenticated users removed from an organization to continue accessing previously granted org-scoped resources such as templates and workspaces via the API. The issue affects Coder versions from 2.0.0 before 2.34.8 and requires verification of Coder version and organization membership to determine exposure. Defenders should prioritize verifying exposure of Coder installations to this vulnerability, especially for users with prior access to organization resources.

Defensive priority

Defenders should prioritize verifying exposure of Coder installations to this vulnerability, especially for users with prior access to organization resources.

Recommended defensive actions

• Verify Coder version and check if it falls within the affected range (2.0.0 to 2.34.7).
• Review organization membership and access control lists (ACLs) for Coder users.
• Update Coder to version 2.34.8 or later if vulnerable.
• Monitor API access for removed organization members.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact requires verification from official sources. The vulnerability affects Coder versions from 2.0.0 before 2.34.8. The issue lies in the acl_allow rule of coderd/rbac/policy.rego, which fails to verify organization membership for per-user ACL entries. Consequently, authenticated users removed from an organization may still access previously granted org-scoped resources like templates and workspaces via the API.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.