CVE-2026-55433— Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspace and, unlike the sibling delete endpoint, performed no `ActionUpdate` check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit `ActionUpdate` authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

授权机制缺失

Coder 授权问题漏洞

Coder是Coder组织开源的一个可以在公共或私有云基础设施中设置开发环境的应用程序。 Coder存在授权问题漏洞，该漏洞源于devcontainer recreate端点仅检查`ActionRead`权限，未在触发破坏性重建前执行`ActionUpdate`检查，可能导致拥有低权限的角色对目标工作区进行未经授权的操作。以下版本受到影响：2.29.7之前版本、2.30.0至2.32.7之前版本、2.33.0至2.33.8之前版本和2.34.0至2.34.2之前版本。

N/A

N/A