CVE-2026-111930

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111930
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111930.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111930
Aliases
  • GHSA-cvrm-2xxr-hpcv
Published
2026-10-17T18:46:41Z
Modified
2026-10-21T02:55:50Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
Details

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111930.json"
}
References

Affected packages

Git / github.com/coder/coder

Affected ranges

Type
GIT
Repo
https://github.com/coder/coder
Events
Introduced
a056cb6577417b71f432084ff2a62a617a5246d9
Fixed
7bd778d8815624fd2b598d9432092162437c06b3
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.26.0"
                },
                {
                    "fixed":  "2.34.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111930.json"