CVE-2026-111929

Coder versions 2.30.0 before 2.34.8 are vulnerable to a cross-organization file disclosure flaw in the provisioner daemon's DownloadFile gRPC handler . An authorization bypass allows authenticated provisioner daemons to download cached Terraform module archives belonging to other organizations. B...