CVE-2026-55077: Coder Admin Password Reset Privilege Escalation (CVSS 7.2)

Technical summary

The `PUT /api/v2/users/{user}/password` endpoint in affected Coder versions implements insufficient authorization checks. The endpoint only validates the `ActionUpdatePersonal` permission and fails to prevent a `user-admin` from resetting the password of an `owner`-role account. Additionally, the endpoint does not enforce current-password verification when an admin resets another user's password. This allows a compromised or malicious admin to gain persistent access to owner accounts by changing their credentials. The fix, introduced in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, adds a check that prevents non-owner users from modifying the password of owner-role accounts.

Business impact

Successful exploitation allows an administrator to hijack owner-level accounts, potentially compromising the entire Coder deployment and all provisioned development environments. Owner accounts typically control organization-wide settings, user management, and infrastructure access. An attacker with this capability could establish persistent backdoor access, exfiltrate sensitive development work, modify infrastructure templates, or disrupt development operations. The risk is heightened in multi-tenant or shared deployments where admins are granted broad permissions but not fully trusted.

Affected systems

Coder versions 2.29.0 through 2.29.6, 2.30.x through 2.32.6, 2.33.0 through 2.33.7, and 2.34.0 through 2.34.1 are affected. Patched versions are 2.29.7, 2.32.7, 2.33.8, and 2.34.2 and later. Deployments using versions 2.35.0 and later (if released after the patch date) are assumed secure. Only Coder instances are affected; other remote development platforms are not impacted. Organizations using Coder should verify their installed version immediately.

Exploitability

Exploitation requires valid credentials and the `user-admin` role within Coder. An attacker cannot exploit this vulnerability externally or from an unprivileged user account. However, the attack surface expands significantly if the `user-admin` role is granted to contractors, junior administrators, or service accounts that may be easier to compromise than top-level owner accounts. No advanced exploitation techniques are required; the attacker simply calls the password reset endpoint for a target owner account, then authenticates with the new credentials.

Remediation

Upgrade Coder to version 2.29.7, 2.32.7, 2.33.8, 2.34.2, or later depending on your current branch. Immediately audit and restrict the `user-admin` role to a minimal set of trusted administrators. Review recent password reset activity and suspicious authentication logs for owner accounts to detect if the vulnerability has been exploited. Enforce strong authentication (multi-factor authentication where supported) on all owner and admin accounts as an additional layer of defense.

Patch guidance

Identify your current Coder version via the administration console or CLI. If you are on the 2.29.x branch, upgrade to 2.29.7 or later. If on 2.30.x or 2.31.x, upgrade to 2.32.7 or later. If on 2.33.x, upgrade to 2.33.8 or later. If on 2.34.x, upgrade to 2.34.2 or later. Consult the Coder release notes and upgrade guide for your specific branch to ensure compatibility and migration steps. Test the upgrade in a non-production environment first, particularly if you rely on custom authentication or provisioner integrations.

Detection guidance

Monitor the audit or access logs for calls to `PUT /api/v2/users/{user}/password` initiated by `user-admin` accounts that modify an owner's credentials. Alert on any password reset of an owner account not performed by the owner themselves. Cross-reference these events with authentication logs to detect if the owner account was used immediately after the reset by an IP address or user agent different from the owner's normal patterns. Implement rate limiting on the password endpoint to slow brute-force or mass admin attacks.

Why prioritize this

This vulnerability earns a HIGH CVSS score (7.2) because it allows full account takeover of owner-level users by a privileged insider. While it requires the `user-admin` role to exploit, many organizations grant that role to multiple staff members, contractors, or automation services—expanding the attack surface. Owner account compromise directly leads to complete infrastructure and data exposure. Any organization using Coder should treat this as a near-critical priority if the `user-admin` role is widely distributed.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) reflects high confidentiality, integrity, and availability impact due to owner account takeover, high privilege requirements (reducing the vector to a networked internal threat), and low complexity. The score does not require active exploitation in the wild; it reflects the severity of compromise if an insider with `user-admin` access turns malicious or becomes compromised. Organizations with tightly scoped admin roles may experience lower real-world risk, but those with broad role delegation face substantial threat.

Frequently asked questions