Executive brief
Coolify, an open-source tool for managing servers and applications, contains a security flaw that allows users to view deployment information belonging to other teams. By providing a specific deployment ID, an authenticated user can access details about another team's application names, server infrastructure, and deployment status. While the IDs are difficult to guess, this vulnerability could lead to the exposure of internal infrastructure details to unauthorized users within the same system.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Coolify's DeployController.php. The `deployment_by_uuid` function retrieves deployment records based on a user-provided UUID without verifying if the deployment's associated server belongs to the authenticated user's team ID. An attacker with valid API credentials can exploit this by sending a GET request to `/api/v1/deployments/{uuid}` with a UUID belonging to a different team. Successful exploitation reveals metadata including application names, server IDs, and commit messages. The vulnerability is mitigated by the use of non-enumerable CUID2 identifiers for deployment UUIDs. The issue is resolved in version 4.0.0-beta.464 by implementing team ownership validation.
Affected products
- coollabsio Coolify < 4.0.0-beta.464
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: CVE published to NVD
- 2026-06-30: patched: Fix released in version 4.0.0-beta.464