CVE-2026-55077: Coder: User-admin role can reset owner account password

The PUT /api/v2/users/{user}/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account’s password. It also did not require the current password when an admin reset another user’s password.

Note: Exploitation requires the privileged user-admin role so practical risk is limited to deployments that grant user-admin to less trusted operators.