CVE-2026-55077

Executive Summary

CVE-2026-55077 is a privilege escalation vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The vulnerability resides in the PUT /api/v2/users/{user}/password endpoint, which incorrectly authorizes password resets. Specifically, the endpoint only checks for the ActionUpdatePersonal permission, allowing a user with the user-admin role to reset the password of an owner account without requiring the current password. This effectively allows a lower-privileged administrator to take over the highest-privileged account in the system. While exploitation requires the user-admin role, the risk is significant in deployments where this role is delegated to less trusted operators. The CVSS score is 7.2 (High), and no public proof-of-concept or exploit code is currently available.

Supply Chain & Package Security

Coder is a Go-based application distributed as a binary or container image. The vulnerability is in the application's API logic, not in a third-party package. However, organizations using Coder should verify their deployment version and apply the patch immediately. No malicious packages or compromised dependencies have been identified in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (user-admin role)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although exploitation requires the user-admin role, the impact is complete compromise of the owner account, which can lead to full system takeover.

Deep Dive & Mechanics

The vulnerability is in the password reset endpoint PUT /api/v2/users/{user}/password. The authorization logic only checks if the authenticated user has the ActionUpdatePersonal permission. This permission is granted to both regular users (for their own password) and user-admin role holders (for managing other users). However, the code does not verify whether the target user is an owner account. Additionally, when an admin resets another user's password, the current password is not required, making the attack straightforward.

Root Cause: Missing authorization check to prevent user-admin from resetting owner passwords. The fix adds a check that denies the request if the target user has the owner role and the requesting user is not also an owner.

Attack Flow:

1. Attacker obtains user-admin role (e.g., through misconfiguration or compromised admin account).
2. Attacker sends a PUT request to /api/v2/users/{owner_username}/password with a new password.
3. The endpoint accepts the request and changes the owner's password.
4. Attacker logs in as the owner and gains full control.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func (s *Service) updateUserPassword(r *http.Request, userID string) {
    // Only checks ActionUpdatePersonal
    if !s.Authorize(r, ActionUpdatePersonal, userID) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // ... update password logic
}

Patched Code (Conceptual):

func (s *Service) updateUserPassword(r *http.Request, userID string) {
    // Check ActionUpdatePersonal
    if !s.Authorize(r, ActionUpdatePersonal, userID) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // Additional check: prevent non-owner from resetting owner password
    targetUser := s.GetUser(userID)
    if targetUser.Role == "owner" && !s.Authorize(r, ActionUpdateOwner, userID) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // ... update password logic
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Coder instance with a user-admin role account.
• Knowledge of the target owner username.

Exploitation Steps:

1. Authenticate as a user-admin and obtain a session token.
2. Send a PUT request to reset the owner's password:

curl -X PUT https://coder.example.com/api/v2/users/owner/password \
  -H "Authorization: Bearer <user-admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"password": "NewP@ssw0rd!"}'

3. Log in as the owner with the new password:

curl -X POST https://coder.example.com/api/v2/users/login \
  -H "Content-Type: application/json" \
  -d '{"email": "owner@example.com", "password": "NewP@ssw0rd!"}'

4. Confirm full access to the owner's resources.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor API logs for password reset requests targeting owner accounts from non-owner users.
2. Alert on any successful password change for an owner account that was not initiated by the owner themselves.
3. Review all user-admin role assignments and ensure they are strictly controlled.

Hunting Query (Splunk):

index=coder_api_logs source="/api/v2/users/*/password"
| search method=PUT status=200
| eval target_user=extract_field("user", uri_path)
| search target_user="owner"
| table _time, user, target_user, src_ip

Indicators of Compromise (IOCs)

• Network: PUT requests to /api/v2/users/{owner_username}/password from non-owner IPs.
• Logs: Successful password change events for owner accounts without corresponding owner authentication.
• Behavior: Unexpected password reset emails or notifications for owner accounts.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_55077_Coder_Password_Reset {
    meta:
        description = "Detects Coder password reset requests targeting owner accounts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-55077"
    strings:
        $s1 = "/api/v2/users/" ascii wide nocase
        $s2 = "/password" ascii wide nocase
        $s3 = "owner" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Coder Owner Password Reset by Non-Owner
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to reset an owner account password in Coder by a non-owner user.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: coder
detection:
    selection:
        http.method: "PUT"
        http.url|contains: "/api/v2/users/"
        http.url|endswith: "/password"
        http.response.status: 200
    filter:
        http.url|contains: "/api/v2/users/owner/password"
    condition: selection and filter
falsepositives:
    - Legitimate owner password reset by the owner themselves (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55077 Coder Owner Password Reset Attempt"; flow:to_server; http.method; content:"PUT"; http.uri; content:"/api/v2/users/"; http.uri; content:"/password"; http.uri; content:"owner"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2 (or later).
2. If upgrade is not possible, restrict the user-admin role to only trusted administrators.
3. Review all current user-admin assignments and remove any unnecessary grants.

Long-term Measures:

• Implement strict role-based access control (RBAC) reviews.
• Enable audit logging for all password change events.
• Monitor for anomalous password reset activities.
• Consider multi-factor authentication (MFA) for all admin accounts.

Workaround: As stated in the advisory, restrict the user-admin role to trusted administrators. This reduces the attack surface but does not eliminate the vulnerability.

Valters IT
Securing Digital Frontiers