CVE-2026-55077 Overview
Coder is a platform that provisions remote development environments via Terraform. CVE-2026-55077 is a broken authorization vulnerability [CWE-285] in the PUT /api/v2/users/{user}/password endpoint. The endpoint authorized only ActionUpdatePersonal and failed to block a user-admin from resetting an owner account password. It also did not require the current password when an admin reset another user's password. An attacker holding the user-admin role can escalate privileges by taking over the highest-privileged owner account.
Critical Impact
A user-admin in Coder can reset the password of an owner account, enabling full takeover of the highest-privileged role and compromise of managed development environments.
Affected Products
- Coder versions prior to 2.29.7
- Coder versions prior to 2.32.7
- Coder versions prior to 2.33.8 and 2.34.2
Discovery Timeline
- 2026-07-07 - CVE-2026-55077 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-55077
Vulnerability Analysis
Coder's password reset endpoint enforces authorization using an action named ActionUpdatePersonal. This action is intended for users updating their own credentials. The endpoint reused that authorization check for administrative password resets performed by user-admin accounts. As a result, the API did not evaluate whether the caller had sufficient privilege to reset an account holding the owner role.
A secondary flaw compounds the impact. The endpoint did not require the current password when an admin reset another user's credentials. A user-admin could therefore submit a new password for any account, including owner, and inherit full platform control by logging in as that user. Practical risk is limited to deployments that grant user-admin to less trusted operators.
Root Cause
The root cause is a missing role-hierarchy check in the authorization layer of the password update handler. The code authorized the action at the personal-scope level rather than validating whether the target account outranked the caller. Coder's own advisory GHSA-29xf-69gq-m9jx and pull request #25709 identify the endpoint and the missing constraint that non-owner users must not reset an owner password.
Attack Vector
Exploitation requires an authenticated Coder session with the user-admin role and network access to the Coder API. The attacker issues a PUT request to /api/v2/users/{user}/password targeting an owner account and supplies a new password. The server accepts the request without requesting the current password. The attacker then authenticates as the owner and gains full administrative control over workspaces, templates, and Terraform-managed infrastructure. See the GitHub Security Advisory GHSA-29xf-69gq-m9jx for the vendor description.
Detection Methods for CVE-2026-55077
Indicators of Compromise
- Unexpected PUT /api/v2/users/{user}/password requests where the target user holds the owner role.
- Password reset audit events initiated by user-admin accounts against high-privilege targets.
- Successful owner logins from IP addresses, user agents, or times inconsistent with the account's baseline.
- New template, workspace, or provisioner activity created by an owner account shortly after a password change.
Detection Strategies
- Correlate Coder audit log entries for password changes with the caller's role and the target's role.
- Alert whenever a non-owner principal issues a password update for an owner account.
- Baseline API call patterns for user-admin accounts and flag deviations that include privileged password operations.
Monitoring Recommendations
- Ship Coder audit logs to a central SIEM or data lake and retain them for incident review.
- Enable authentication and session logging for all owner accounts, including source IP and MFA state.
- Track pull request #25709 references and downstream release notes to confirm patched builds in production.
How to Mitigate CVE-2026-55077
Immediate Actions Required
- Upgrade Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2 depending on your release track.
- Audit all accounts holding the user-admin role and remove the role from any operator that is not fully trusted.
- Rotate passwords for all owner accounts and require multi-factor authentication for privileged logins.
- Review the audit log for prior password reset activity performed by user-admin accounts against owner targets.
Patch Information
Coder released fixes in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The patch prevents non-owner users from resetting the password of an account that holds the owner role. Full details are available in GitHub Pull Request #25709 and the GitHub Security Advisory GHSA-29xf-69gq-m9jx. Release artifacts are published as v2.29.17, v2.32.7, v2.33.8, and v2.34.2.
Workarounds
- Restrict the user-admin role to a small set of vetted administrators until patched builds are deployed.
- Require organizational approval and change-management review before granting user-admin in any environment.
- Enforce MFA on all owner accounts so that a stolen password alone does not permit login.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
