Coder EUVD-2026-103295

Exploitation requires the attacker to be an authenticated Coder user who (1) was previously granted a per-user ACL entry on an org-scoped resource such as a template or workspace, and (2) was subsequently removed from that organization while retaining a valid account. The limiting factors are significant: there is no path for an anonymous or never-privileged attacker, the target must use Coder's per-user ACL grants rather than only role/group permissions, and the attacker's account must remain active after org removal. Impact is confined to continued access to the specific resources that were ACL-granted before removal (templates and workspaces), not organization-wide access.

This is a moderate-severity authorization flaw (CVSS 4.0 base 5.3, CWE-863) whose real-world risk is bounded rather than widespread. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) correctly signals network-reachable, low-complexity exploitation but requires PR:L - the attacker must be an authenticated principal, specifically one who previously held per-user ACL grants and was then removed from an organization. There is no KEV listing, no EPSS score, and no POC referenced in the supplied intelligence, so there is no evidence of active or opportunistic exploitation; exploitation status is 'no public exploit identified at time of analysis.' Impact is limited to low confidentiality and low integrity (VA:N) and there is no scope change, which is consistent with retained read/use access to org-scoped templates and workspaces rather than full compromise. No SSVC decision data was provided. The signals are internally consistent - this is a genuine-but-narrow insider/offboarding risk (a former org member retaining access), not a mass-exploitable critical. Priority should be driven by whether an organization actually relies on Coder's org/ACL boundary for tenant separation; for those deployments it is a real offboarding-security gap, otherwise it is a lower-urgency hygiene fix.

A contractor is granted per-user ACL access to specific templates and workspaces in a Coder organization, then is removed from that organization during offboarding. Because org membership is not re-checked on per-user ACL entries and removal does not scrub those entries, the former member continues calling the Coder API with their still-valid account and keeps reading and using those org-scoped resources. No public exploit code is referenced; exploitation requires only the retained account and prior ACL grants.