CVE-2026-126308 | Coder up to 2.38.1 Web Dashboard SESSION_TOKEN access control

November 13, 2026 Yanac

A vulnerability classified as problematic was found in Coder up to 2.29.22/2.34.13/2.36.8/2.37.5/2.38.1. The affected element is an unknown function of the component Web Dashboard. Such manipulation of the argument SESSION_TOKEN leads to improper access controls.

This vulnerability is uniquely identified as CVE-2026-126308. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More