Coder EUVD-2026-103297

Exploitation requires an authenticated Coder account (PR:L) that has been granted 'use' access to a target workspace via its ACL - this is the specific, concrete prerequisite stated in the description. The flaw is in the GET /api/v2/workspaces/{id}/acl endpoint, which validates only workspace read access yet resolves group membership under an elevated system context, so any user meeting the 'use'-access bar can trigger it against affected versions (2.26.0 up to but not including 2.34.8) with no user interaction and against default configurations. Limiting factors: the attacker cannot be fully anonymous (valid credentials and workspace access are needed), impact is confined to disclosure of group members' account metadata rather than credentials or code, and unaffected versions (2.34.8+) are not exploitable.

This is a genuine but modest-severity information disclosure flaw, not a top-tier priority. All signals point consistently to limited risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires low privileges (PR:L) - the attacker must already be an authenticated Coder user with workspace 'use' access, which is a meaningful barrier. Vulnerable-system impact is confidentiality-only and rated Low (VC:L, with VI:N/VA:N), reflecting disclosure of group members' account metadata (emails, login types, status, timestamps) rather than secrets, credentials, or code. No conflicting signals exist between the CVSS vector and the description - both agree on authenticated network access with low confidentiality impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or probable exploitation; absence of these is expected for a recently disclosed medium-severity issue and should not be read as either reassurance or alarm. Net assessment: a legitimate privilege-scoping bug worth patching on a normal cycle, but not an emergency given the authentication requirement and metadata-only impact.

An authenticated Coder user who has only been granted 'use' access to a shared workspace (e.g. a contractor or low-trust team member) sends a GET request to /api/v2/workspaces/{id}/acl. Because the endpoint checks only workspace read access but fetches group membership under an elevated system context, the server returns the emails, login types, account status, and last-seen/creation timestamps of all members of groups on that workspace's ACL. No public exploit code was identified at time of analysis, but exploitation is trivial - a single authenticated HTTP request.