---
id: CVE-2026-111930
title: >-
  Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL
  Endpoint
summary: >-
  Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in
  the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read
  access and then fetches group members using an elevated system context.
  Authentica…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: coder
product: coder
affected:
  - coder >= 2.26.0 < 2.34.8
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T18:46:41.399Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111930'
references:
  - url: 'https://github.com/coder/coder/security/advisories/GHSA-cvrm-2xxr-hpcv'
    label: GitHub Security Advisory (GHSA-cvrm-2xxr-hpcv)
  - url: >-
      https://www.vulncheck.com/advisories/coder-from-2.26.0-before-2.34.8-information-disclosure-via-workspace-acl-endpoint
    label: >-
      VulnCheck Advisory: Coder from 2.26.0 before 2.34.8 Information Disclosure
      via Workspace ACL Endpoint
tags:
  - cve.org
ingestedAt: '2026-10-17T19:08:56.750Z'
---

## Overview

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.

## Affected

- `coder >= 2.26.0 < 2.34.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.