CVE-2026-55077— Coder: User-admin role can reset owner account password

Coder: User-admin role can reset owner account password

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. Exploitation requires the privileged `user-admin` role so practical risk is limited to deployments that grant `user-admin` to less trusted operators. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 prevents non-owner users from resetting the password of an account that holds the `owner` role. As a workaround, restrict the `user-admin` role to trusted administrators.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

授权机制不恰当

Coder 授权问题漏洞

Coder是Coder组织开源的一个可以在公共或私有云基础设施中设置开发环境的应用程序。 Coder存在授权问题漏洞，该漏洞源于在 `PUT /api/v2/users/{user}/password` 端点授权不当，仅检查 `ActionUpdatePersonal`，未阻止 `user-admin` 重置 `owner` 账户密码，且管理员重置其他用户密码时无需当前密码，可能导致权限提升。以下版本受到影响：2.29.7之前版本、2.32.7之前版本、2.33.8之前版本和2.34.2之前版本。

N/A

N/A