CVE-2026-55077 PUBLISHED

Coder: User-admin role can reset owner account password

Assigner: GitHub_M
Reserved: 16.06.2026 Published: 07.07.2026 Updated: 07.07.2026

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/{user}/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's password. It also did not require the current password when an admin reset another user's password. Exploitation requires the privileged user-admin role so practical risk is limited to deployments that grant user-admin to less trusted operators. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 prevents non-owner users from resetting the password of an account that holds the owner role. As a workaround, restrict the user-admin role to trusted administrators.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor coder
Product coder
Versions
  • Version >= 2.34.0, < 2.34.2 is affected
  • Version >= 2.33.0, < 2.33.8 is affected
  • Version >= 2.30.0, < 2.32.7 is affected
  • Version < 2.29.17 is affected

References

Problem Types

  • CWE-285: Improper Authorization CWE