The vulnerability arises from an incorrect authorization check in the GET /api/v2/workspaces/{id}/acl endpoint of Coder. The endpoint verifies only workspace read access, yet it retrieves group member data—email addresses, login types, status, and timestamps—using an elevated system context. Authenticated users who possess workspace use access can exploit this flaw to harvest sensitive user information, thereby exposing confidential data to unauthorized individuals. This flaw is classified as CWE-200, Information Exposure.

The flaw exists in the Coder application, from version 2.26.0 up to, but not including, 2.34.8. Any deployment of Coder in this version range that exposes the /api/v2/workspaces/{id}/acl endpoint to authenticated users can be impacted.

Attackers need to be authenticated with workspace use permissions; the endpoint is reachable over the network, so the attack vector is network based. The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no large‑scale known exploitation yet. Nonetheless, any authenticated user who is granted workspace use access can gain visibility of group members across the organization, which could aid in phishing or social engineering. The risk is therefore moderate but non‑negligible, especially in environments with large user bases or sensitive data.