CVE-2026-55077
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/{user}/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's password. It also did not require the current password when an admin reset another user's password. Exploitation requires the privileged user-admin role so practical risk is limited to deployments that grant user-admin to less trusted operators. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 prevents non-owner users from resetting the password of an account that holds the owner role. As a workaround, restrict the user-admin role to trusted administrators.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| coder | coder | >= 2.34.0, < 2.34.2 | affected |
| coder | coder | >= 2.33.0, < 2.33.8 | affected |
| coder | coder | >= 2.30.0, < 2.32.7 | affected |
| coder | coder | < 2.29.17 | affected |
Weaknesses
- CWE-285: CWE-285: Improper Authorization
References
- https://github.com/coder/coder/security/advisories/GHSA-29xf-69gq-m9jx
- https://github.com/coder/coder/pull/25709
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.