The devcontainer recreate endpoint in Coder was configured to perform a destructive rebuild of a workspace container without first verifying that the caller had write or update privileges. A user with only read access could therefore trigger a full container recreation, effectively wiping the workspace and losing all local data. This missing write‑authorization flaw is identified as CWE‑862 and directly enables an unauthorized actor to cause irreversible data loss.

The vulnerability impacts Coder deployments using any release version prior to 2.29.7, 2.32.7, 2.33.8, or 2.34.2, and those installations are at risk if any low‑privilege role has access to a target workspace.

The CVSS score of 5.4 indicates a moderate overall impact. The EPSS score is below 1%, reflecting a low estimated probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a pre‑existing low‑privilege role that already has access to the target workspace; no workarounds are available. Until patching and RBAC tightening are performed, an attacker could repeatedly trigger destructive rebuilds on any workspace they can read, causing irreversible data loss for that workspace.