CVE-2026-111928

Coder versions 2.0.0 before 2.34.8 are vulnerable to an incorrect authorization flaw (CWE-863) within the acl_allow rule of coderd/rbac/policy.rego. The root cause is a failure to verify organization membership for per-user ACL entries, combined with the fact that removing an organization member ...

EUVD-2026-103295

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the aclallow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from ...