The vulnerability in Coder’s provisioner daemon causes an authorization bypass in the DownloadFile gRPC handler. An authenticated provisioner with an organization‑scoped key can request a cached Terraform module from any other organization by supplying the file UUID. The leaked file contains module source code, which may expose infrastructure topology and embedded secrets, leading to confidentiality compromise.

Affected systems: The CNA lists coder:coder, and the vulnerability description notes that Coder from 2.30.0 before 2.34.8 is impacted. No explicit affected‑version range is provided in the CNA fields, so the exact scope cannot be confirmed without further vendor guidance; all deployments using those releases should be considered at risk unless upgraded to 2.34.8 or later.

The CVSS score is 6, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated provisioner key and knowledge of a file UUID, so based on the description it is inferred that the attack vector is a network‑based authenticated request, but does not require privileged system access. Once the conditions are met, the attacker can retrieve sensitive module code from any organization.