CVE-2026-111928Medium· 5.4▾ SunlitCoder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal do…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
coder >= 2.0.0 < 2.34.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111929Medium· 5.3Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
CVE-2026-63443High· 8.3Coder allows organizations to provision remote development environments via Terraform
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
CVE-2025-71435Medium· 4.2Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
CVE-2026-111930Medium· 4.3Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
CVE-2026-111931Medium· 4.3Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy