Coder CVE-2026-111929

Exploitation requires a multi-organization Coder deployment running an affected version (2.30.0 through 2.34.7) and an attacker possessing a valid org-scoped provisioner key (PR:L) PLUS prior knowledge of the specific file UUID of a target organization's cached Terraform module archive. The authorization bypass is in the provisioner daemon's DownloadFile gRPC handler, which does not validate cross-organization ownership of the requested file. Limiting factors: UUIDs are not enumerable/guessable (driving the high attack complexity), so the attacker must already know or obtain the target identifier out of band; a legitimate provisioner credential is mandatory, so this is not exploitable by fully unauthenticated external attackers; and single-organization deployments have no other organization's data to disclose, materially reducing real-world exposure.

This is a medium-severity (CVSS 4.0 base 6.0) authorization bypass (CWE-863) in Coder's provisioner daemon DownloadFile gRPC handler, and the available signals consistently point to a moderate, non-urgent priority rather than a top-of-queue emergency. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N) confirms a network-reachable flaw but with high attack complexity and required privileges: an attacker must already hold a valid org-scoped provisioner key (PR:L) AND know a specific target file UUID (AC:H), which cannot be feasibly brute-forced. Impact is confidentiality-only (VC:H, VI:N, VA:N, no scope/subsequent-system impact), meaning disclosure of cross-organization cached Terraform module archives but no integrity or availability damage. No EPSS score, SSVC decision, KEV listing, or POC is present in the input - so exploitation probability signals are absent, not low; there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is driven by the sensitivity of what the modules may contain (infrastructure topology, embedded secrets), which could enable follow-on attacks, but the dual prerequisites (valid provisioner credential + known UUID) make this a targeted-insider or compromised-tenant scenario rather than a widespread, automatable threat. Bottom line: a real but bounded cross-tenant data-leak issue for multi-org Coder deployments; patch in the normal cycle, prioritizing higher if you run shared multi-organization Coder with sensitive Terraform modules.

In a multi-organization Coder deployment, an attacker who controls (or has compromised) a provisioner daemon in Organization A uses its valid org-scoped provisioner key to call the DownloadFile gRPC handler with a file UUID belonging to Organization B's cached Terraform module archive. Because the handler fails to enforce organization ownership, it returns Organization B's module source, potentially exposing infrastructure topology or embedded secrets. The high attack complexity (the attacker must already know the specific target UUID) and the requirement for a legitimate provisioner credential limit this to insiders or an attacker who has already gained a foothold; no public exploit code is identified at time of analysis.