Executive brief
Coder is a platform used by organizations to manage and deploy remote development environments. A security flaw allowed users with limited permissions to trigger a destructive rebuild of development workspaces they should only be able to view. This could lead to unauthorized service disruptions and the loss of unsaved work within those environments.
Technical details
A missing authorization vulnerability (CWE-862) exists in Coder's devcontainer recreate endpoint. The endpoint's route middleware only verified 'ActionRead' permissions on the target workspace, failing to require 'ActionUpdate' before initiating a destructive rebuild. An attacker with a low-privileged role and read access to a workspace could exploit this over the network to force a workspace recreation. The issue has been resolved in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by adding an explicit 'ActionUpdate' authorization check.
Affected products
- Coder Coder < 2.29.17, >= 2.30.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.2
Timeline
- 2026-05-28: other: Fix merged into main branch
- 2026-06-11: patched: Security releases v2.32.7, v2.33.8, and v2.34.2 published
- 2026-06-12: patched: Security release v2.29.17 published
- 2026-07-08: advisory: CVE published to NVD
References
- https://github.com/coder/coder/pull/25812
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
- https://github.com/coder/coder/security/advisories/GHSA-jqj2-x4c5-jfxm