The vulnerability is a logic flaw in the ACL authorization rule within coderd/rbac/policy.rego. The rule mistakenly allows any authenticated user who was previously granted a per‑user ACL to continue accessing organization‑scoped resources even after their membership in the organization has been revoked. Because the rule does not verify current organization membership, the attacker can use the API to retrieve templates, workspaces, or other resources that should have been denied.

The flaw affects the Coder application from version 2.0.0 up to and including 2.34.7 (any release before 2.34.8). All installations of coder that have user‑level ACL entries within organization‑scoped resources are potentially impacted. The vulnerability is present in the coderd component of the Coder server.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the flaw remains exploitable by authenticated users who have been removed from an organization. The likely attack vector is a remote API request authenticated as the user, which bypasses the missing organization membership check and grants continued access to deleted resources. Because the exploitation path requires only existing credentials and no additional privileged permissions, the risk to affected organizations is significant if unpatched.