https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-14T08:01:28.634378+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-126404 CVE-2026-126404 — Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation 2026-11-14T08:01:28.636240+00:00

Affected: coder

Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.