CVE-2026-111929CWE-863broken-access-control

CVE-2026-111929

Medium · published October 17, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00199 · 9.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-17T23:16Z
References (2)
https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc · [email protected]https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc · [email protected]
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
    cvelistv5
  • 17 OCT 18:46Z
    Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
    cvelistv5