CVE-2026-55433: coder Missing Authorization

Vulnerability summary

CVE-2026-55433 is a medium (CVSS 5.4) Missing Authorization vulnerability in coder. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.1% of scored vulnerabilities.

Timeline

1. 08-07-2026
   PublishedVulnerability first disclosed.
2. 08-07-2026
   Last modifiedVulnerability information updated.

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspace and, unlike the sibling delete endpoint, performed no `ActionUpdate` check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit `ActionUpdate` authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.