GHSA-29xf-69gq-m9jx

Source

https://github.com/advisories/GHSA-29xf-69gq-m9jx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-29xf-69gq-m9jx/GHSA-29xf-69gq-m9jx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-29xf-69gq-m9jx

Aliases

Published

2026-07-06T20:53:04Z

Modified

2026-07-07T16:11:05.150184678Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Coder: User-admin role can reset owner account password

Details

Summary

The PUT /api/v2/users/{user}/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's password. It also did not require the current password when an admin reset another user's password.

Note: Exploitation requires the privileged user-admin role so practical risk is limited to deployments that grant user-admin to less trusted operators.

Impact

A user-admin could reset any owner's password without knowing it, authenticate as that owner and gain full deployment control, including templates, workspaces, licensing, organization settings and the ability to self-assign the owner role. This was a privilege escalation from user-admin to owner.

Patches

The fix prevents non-owner users from resetting the password of an account that holds the owner role.

The fix was backported to all supported release lines:

| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |

Workarounds

Restrict the user-admin role to trusted administrators until upgrading.

Resources

Fix: #25709

Credits

Coder would like to thank Anthropic's Security Team (ANT-2026-22436) for independently disclosing this issue!

Database specific

{
    "severity": "HIGH",
    "nvd_published_at": null,
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-285"
    ],
    "github_reviewed_at": "2026-07-06T20:53:04Z"
}

References

Affected packages

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.34.0

Fixed

2.34.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-29xf-69gq-m9jx/GHSA-29xf-69gq-m9jx.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.33.0

Fixed

2.33.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-29xf-69gq-m9jx/GHSA-29xf-69gq-m9jx.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.30.0

Fixed

2.32.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-29xf-69gq-m9jx/GHSA-29xf-69gq-m9jx.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.29.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-29xf-69gq-m9jx/GHSA-29xf-69gq-m9jx.json"