CVE-2026-126404
EUVD-2026-12516113.11.2026, 10:17
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.EnginsightEarly Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| coder | coder | 2.38.0 ≤ 𝑥 < 2.38.4 | CNA |
| coder | coder | 2.37.0 ≤ 𝑥 < 2.37.8 | CNA |
| coder | coder | 2.36.0 ≤ 𝑥 < 2.36.11 | CNA |
| coder | coder | 2.30.0 ≤ 𝑥 < 2.34.16 | CNA |
| coder | coder | 2.28.0 ≤ 𝑥 < 2.29.24 | CNA |
| coder | coder | 2.35.0 ≤ 𝑥 < 2.36.0 | CNA |
Common Weakness Enumeration