{"id":"CVE-2026-55077","aliases":["GHSA-29xf-69gq-m9jx"],"title":"Coder: User-admin role can reset owner account password","summary":"Coder: User-admin role can reset owner account password","severity":"high","cvss":7.2,"cwe":["CWE-285"],"vendor":"coder","product":"github.com/coder/coder/v2","ecosystem":"go","affected":["github.com/coder/coder/v2 >= 2.34.0, < 2.34.2","github.com/coder/coder/v2 >= 2.33.0, < 2.33.8","github.com/coder/coder/v2 >= 2.30.0, < 2.32.7","github.com/coder/coder/v2 < 2.29.17"],"patched":["github.com/coder/coder/v2 2.34.2","github.com/coder/coder/v2 2.33.8","github.com/coder/coder/v2 2.32.7","github.com/coder/coder/v2 2.29.17"],"published":"2026-07-06","updated":"2026-07-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-29xf-69gq-m9jx","references":[{"url":"https://github.com/coder/coder/security/advisories/GHSA-29xf-69gq-m9jx"},{"url":"https://github.com/coder/coder/pull/25709"},{"url":"https://github.com/advisories/GHSA-29xf-69gq-m9jx"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-06T21:45:52.975Z","epss":0.00615,"epssPercentile":0.47792,"slug":"CVE-2026-55077","body":"## Overview\n\n### Summary\n\nThe `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password.\n\n> **Note:** Exploitation requires the privileged `user-admin` role so practical risk is limited to deployments that grant `user-admin` to less trusted operators.\n\n### Impact\n\nA `user-admin` could reset any owner's password without knowing it, authenticate as that owner and gain full deployment control, including templates, workspaces, licensing, organization settings and the ability to self-assign the `owner` role. This was a privilege escalation from `user-admin` to `owner`.\n\n### Patches\n\nThe fix prevents non-owner users from resetting the password of an account that holds the `owner` role.\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) |\n| 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) |\n| 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) |\n| 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |\n\n### Workarounds\n\nRestrict the `user-admin` role to trusted administrators until upgrading.\n\n### Resources\n- Fix: #25709\n\n### Credits\n\nCoder would like to thank Anthropic's Security Team (ANT-2026-22436) for independently disclosing this issue!\n\n## Affected packages\n\n- `github.com/coder/coder/v2 >= 2.34.0, < 2.34.2`\n- `github.com/coder/coder/v2 >= 2.33.0, < 2.33.8`\n- `github.com/coder/coder/v2 >= 2.30.0, < 2.32.7`\n- `github.com/coder/coder/v2 < 2.29.17`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/coder/coder/v2 2.34.2`\n- `github.com/coder/coder/v2 2.33.8`\n- `github.com/coder/coder/v2 2.32.7`\n- `github.com/coder/coder/v2 2.29.17`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}