CVE-2026-111932: coder 2.34.0 to before 2.34.2, 2.33.0 to before 2.33.8, 2.30.0 to before 2.32.7 (+1 more affected versions)

Affected technology

coder · 2.34.0 to before 2.34.2
coder

coder · 2.33.0 to before 2.33.8
coder

coder · 2.30.0 to before 2.32.7
coder

coder · 0 to before 2.29.17
coder

Description’s affected range: before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · Passive user interaction

What an attacker can do

Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality and availability impact as none; integrity impact as low.