Vulnerability · Published Oct 17, 2026 · Assigned by VulnCheck

CVE-2026-111930Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Medium 4.3

In plain English

A medium-severity information exposure in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 91.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.

Affected products (as reported)

Vendor	Product	Versions
coder	coder	2.26.0 – before 2.34.8

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-cvrm-2xxr-hpcv) vendor-advisory
VulnCheck Advisory: Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint third-party-advisory