Coder EUVD-2026-103299

Requires an authenticated user holding the Owner role - the top-tier administrative role in a Coder deployment that already has full control - to write HTML markup into the ApplicationName or LogoURL appearance settings. The payload only affects others when those users subsequently view the Coder dashboard or receive/open SMTP notification emails (UI:P), so successful impact depends on the deployment having SMTP notifications enabled and/or other users actively using the dashboard. The dominant limiting factor is the Owner-role requirement (PR:H): an attacker without administrative credentials cannot reach this flaw, which is why the vendor recommends restricting the Owner role to trusted administrators as a workaround.

This is a genuinely low-priority issue despite being a stored-injection flaw. The CVSS 4.0 base score is only 4.8 (Medium), and every signal reinforces limited real-world risk. The vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) shows that exploitation requires the Owner role - the single most privileged role in a Coder deployment, holding full administrative control - so the attacker is already a trusted super-admin before the flaw is relevant. The impact is confined to limited integrity (VI:L/SI:L) with no confidentiality or availability effect, consistent with HTML injection rather than full script execution. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit code was referenced, so exploitation status is: no public exploit identified at time of analysis. The vendor explicitly notes that 'practical impact is limited' because the required Owner role already has full control. No signals conflict here - all sources (NVD-style CVSS, vendor advisory, and the reporter) agree this is a defense-in-depth hardening fix, not an urgent threat. The only mildly elevating factor is that injected markup reaches other deployment users via the dashboard and outbound SMTP notification emails, giving a malicious or compromised Owner a minor phishing/defacement vector against lower-privileged users.

A malicious or compromised Owner-role user edits the deployment's ApplicationName or LogoURL appearance settings to embed HTML markup. That markup is stored and later rendered unescaped in the Coder dashboard and in SMTP notification emails delivered to other deployment users, enabling content spoofing or phishing against those users when they view the dashboard or open the emails. No public proof-of-concept exploit code was identified in the provided data, and exploitation requires the pre-existing highly privileged Owner role plus the victim viewing the rendered content (UI:P).