The vulnerability in Coder allows a user with the privileged user-admin role to call the password reset endpoint and change the password of an account that holds the owner role without providing the current password. This bypasses normal authorization checks, granting the attacker control over the owner account. While the flaw does not directly lead to code execution, it does enable an attacker to gain full administrative access to the system by compromising the owner account, potentially leading to data theft, configuration changes, and further exploitation. This is an example of an authorization bypass (CWE-285).

The flaw exists in versions of Coder earlier than 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The product is Coder, a platform that provisions remote development environments.

The CVSS score of 7.2 indicates a high severity. The EPSS score is less than 1%, indicating a very low but non‑zero exploitation probability, and the flaw is not listed in the CISA KEV catalog. The attack requires the user-admin role, so the practical risk depends on how that role is allocated. In environments where user‑admin privileges are granted to trusted administrators only, the threat is mitigated; otherwise an attacker who has or can obtain user‑admin access can reset an owner password and take over the account. No special environment or configuration restrictions beyond role assignment are necessary to exploit.