CVE-2026-111930 coder CVE debrief

Who should care

Defenders responsible for Coder installations, especially those using versions between 2.26.0 and 2.34.8, should assess exposure and prioritize verification and potential mitigations.

Why it matters

CVE-2026-111930 is a medium-severity vulnerability in Coder that allows authenticated users to harvest group members' sensitive information. Defenders should prioritize verifying exposure, assessing impact, and implementing potential mitigations.

• Potential information disclosure of group members' sensitive information
• Possible unauthorized access to sensitive group member data
• Need for verification of Coder version and exposure
• Potential for lateral movement or further exploitation

Technical summary

The vulnerability is caused by an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint of Coder, which allows authenticated users with workspace use access to query the endpoint and harvest group members' emails, login types, status, and timestamps. This issue arises from insufficient access controls, enabling attackers to gather sensitive information about group members. To mitigate this vulnerability, defenders should focus on verifying exposure, assessing the impact on their systems, and implementing necessary security measures.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using Coder versions between 2.26.0 and 2.34.8.

Recommended defensive actions

• Verify Coder version and assess exposure
• Restrict access to the /api/v2/workspaces/{id}/acl endpoint
• Monitor for suspicious activity on the affected endpoint
• Implement compensating controls for exposed systems
• Review asset inventory for affected systems
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.