Description
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| coder | coder | 2.38.0 – < 2.38.4, 2.37.0 – < 2.37.8, 2.36.0 – < 2.36.11, 2.30.0 – < 2.34.16, 2.28.0 – < 2.29.24, 2.35.0 – < 2.36.0 | 2.38.4 |
References
- GitHub Security Advisory (GHSA-x3gf-xv6p-56hf) vendor-advisory
- VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation third-party-advisory