CVE-2026-111928

Coder versions 2.0.0 before 2.34.8 are vulnerable to an incorrect authorization flaw (CWE-863) within the acl_allow rule of coderd/rbac/policy.rego. The root cause is a failure to verify organization membership for per-user ACL entries, combined with the fact that removing an organization member ...