CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

EUVD-2026-103297

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930

The Coder platform, versions 2.26.0 before 2.34.8 , is susceptible to an information disclosure vulnerability due to an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint. The system fails to properly validate permissions, checking only for workspace read access before f...

CVE-2026-111928

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the aclallow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from ...

CVE-2026-111928 Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the aclallow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from ...

EUVD-2026-103295

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the aclallow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from ...

EUVD-2026-103294

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111909 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111909

Versions of phpMyFAQ prior to 4.1.9 are vulnerable to a missing authorization flaw within the deleteUser() API. Authenticated users who possess the delete_user permission, but are not superadmins, can exploit this by sending a DELETE request to /admin/api/user/delete. By targeting a superadmin's ...

CVE-2026-111909 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111909

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

EUVD-2026-103311

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111909 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111907

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

EUVD-2026-103312

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global editfaq permission and does not verify access to the target FAQ. Authenticated users with editfaq...

CVE-2026-111908

The phpMyFAQ software (versions 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta ) is vulnerable to a broken object-level authorization (BOLA) flaw in the PUT /api/v3.1/faq/update endpoint. The root cause is that the application verifies the global edit_faq permission but fails to validate if...