---
id: CVE-2026-111929
title: >-
  Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile
  RPC
summary: >-
  Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability
  in the provisioner daemon DownloadFile gRPC handler that allows authenticated
  provisioner daemons to download other organizations' cached Terraform module
  arc…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: coder
product: coder
affected:
  - coder >= 2.30.0 < 2.34.8
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T18:46:40.707Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111929'
references:
  - url: 'https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc'
    label: GitHub Security Advisory (GHSA-hrhj-hpwc-9hmc)
  - url: >-
      https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc
    label: >-
      VulnCheck Advisory: Coder 2.30.0 before 2.34.8 Cross-Organization File
      Disclosure via DownloadFile RPC
tags:
  - cve.org
ingestedAt: '2026-10-17T19:08:56.710Z'
---

## Overview

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.

## Affected

- `coder >= 2.30.0 < 2.34.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.