CVE-2025-58437: coder Insecure Inherited Permissions

Vulnerability summary

CVE-2025-58437 is a high (CVSS 8.1) Insecure Inherited Permissions vulnerability in coder. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-09-2025
   PublishedVulnerability first disclosed.
2. 08-09-2025
   Last modifiedVulnerability information updated.

Description

Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2.

• CWE-277Insecure Inherited PermissionsA product defines a set of insecure permissions that are inherited by objects that are created by the program.
• CWE-279Incorrect Execution-Assigned PermissionsWhile it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."