Summary
The RBAC policy engine in Coder does not verify organization membership when evaluating per-user ACL entries on organization-scoped resources. This allows a user who was explicitly granted access to an org-scoped resource (such as a template) via a user-level ACL entry to retain that access after being removed from the organization.
Affected Component
coderd/rbac/policy.rego — the acl_allow rule for per-user ACL entries.
The group-level ACL rule correctly requires org membership before granting access, but the user-level ACL rule does not include this check. Additionally, the organization member deletion path does not remove stale user-ACL entries from org-scoped resources (templates, workspaces, etc.), so ACL grants persist after offboarding.
Impact
A user who:
- Was explicitly granted per-user ACL access to an org-scoped resource (e.g., a template), and
- Was subsequently removed from the organization
can continue to access that resource via the API. The stale ACL entry is sufficient to authorize the request because the user-ACL evaluation path does not verify current organization membership.
This is a privilege-persistence issue affecting multi-organization deployments where user-level ACLs are used on org-scoped resources. It does not allow unauthenticated access or privilege escalation beyond previously granted permissions.
Prerequisites for Exploitation
- The target user must have been explicitly granted a per-user ACL entry on an org-scoped resource by an administrator.
- The user must have been removed from the organization without the ACL entry being manually revoked.
- Multi-organization deployments are primarily affected.
Remediation
Either:
- Add an org-membership check to the user-level ACL rule in the RBAC policy (matching the existing group-level ACL rule), or
- Scrub user-ACL entries from org-scoped resources when a member is removed from an organization, or
- Both.
Administrators can mitigate this issue immediately by manually revoking user-level ACL entries on org-scoped resources before removing a user from an organization.
Patched versions
This issue is fixed in the following releases:
Credits
We'd like to thank Anthropic's Security Team (ANT-2026-22460) for independently disclosing this issue!
Summary
The RBAC policy engine in Coder does not verify organization membership when evaluating per-user ACL entries on organization-scoped resources. This allows a user who was explicitly granted access to an org-scoped resource (such as a template) via a user-level ACL entry to retain that access after being removed from the organization.
Affected Component
coderd/rbac/policy.rego— theacl_allowrule for per-user ACL entries.The group-level ACL rule correctly requires org membership before granting access, but the user-level ACL rule does not include this check. Additionally, the organization member deletion path does not remove stale user-ACL entries from org-scoped resources (templates, workspaces, etc.), so ACL grants persist after offboarding.
Impact
A user who:
can continue to access that resource via the API. The stale ACL entry is sufficient to authorize the request because the user-ACL evaluation path does not verify current organization membership.
This is a privilege-persistence issue affecting multi-organization deployments where user-level ACLs are used on org-scoped resources. It does not allow unauthenticated access or privilege escalation beyond previously granted permissions.
Prerequisites for Exploitation
Remediation
Either:
Administrators can mitigate this issue immediately by manually revoking user-level ACL entries on org-scoped resources before removing a user from an organization.
Patched versions
This issue is fixed in the following releases:
Credits
We'd like to thank Anthropic's Security Team (ANT-2026-22460) for independently disclosing this issue!