CyberRota Analysis
AI-GeneratedThe vulnerability allows a `user-admin` to reset the password of an `owner` account without requiring the current password, potentially leading to unauthorized access and control over critical resources. Organizations using affected versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 should prioritize patching to mitigate this risk, especially if the `user-admin` role is granted to less trusted operators. It is recommended to restrict the `user-admin` role to trusted personnel as an immediate workaround.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. Exploitation requires the privileged `user-admin` role so practical risk is limited to deployments that grant `user-admin` to less trusted operators. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 prevents non-owner users from resetting the password of an account that holds the `owner` role. As a workaround, restrict the `user-admin` role to trusted administrators.
Related CVEs
Other vulnerabilities affecting the same vendor(s)