CVE-2026-55077 coder CVE debrief

Who should care

Organizations using Coder for remote development environments should be aware of this vulnerability, especially if they have granted the `user-admin` role to operators who should not have such privileges. Deployments with less trusted `user-admin` role holders are at higher risk.

Technical summary

The vulnerability in Coder's `PUT /api/v2/users/{user}/password` endpoint allowed `user-admin` roles to reset passwords of `owner` accounts without knowing the current password. This was due to insufficient authorization checks. The CVSS score is 7.2 (High). The vulnerability was addressed in multiple versions of Coder. Affected deployments should prioritize patching, especially if `user-admin` roles are granted to less trusted users. The fix prevents non-owner users from resetting the password of an account holding the `owner` role.

Defensive priority

High priority for organizations using Coder, especially those with `user-admin` roles granted to less trusted users.

Recommended defensive actions

• Review and restrict `user-admin` role assignments to trusted administrators.
• Upgrade to Coder versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2, or later.
• Monitor for unusual password reset activities.
• Implement additional logging and auditing for user-admin actions.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. Additional references include GitHub pull requests and release notes for patched versions. The vulnerability has a high CVSS score of 7.2, indicating a significant risk, particularly in deployments where the `user-admin` role is granted to less trusted operators. Evidence of exploitation is limited, but defenders should verify patch deployment and monitor for unusual password reset activities.

Official resources