Executive brief
Coolify, an open-source tool for managing servers and application deployments, contains a security flaw that allows users to view deployment information belonging to other teams. An authenticated user could exploit this to access sensitive details such as server names, application metadata, and potentially build logs containing credentials or API keys. This vulnerability breaks the isolation between different teams using the same Coolify instance, potentially leading to the exposure of private infrastructure details.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `GET /api/v1/deployments/{uuid}` endpoint of Coolify. While the application correctly extracts the `teamId` from the user's authentication token, it fails to use this identifier to scope the database query for the requested deployment. Consequently, any authenticated user who knows or guesses a deployment UUID can retrieve its details, regardless of team ownership. Exposed data includes application and server metadata, commit messages, and build logs which may contain environment variables or secrets. The issue is resolved in version 4.0.0-beta.464 by implementing team ownership verification before returning deployment data.
Affected products
- coollabsio Coolify < 4.0.0-beta.464
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date
- 2026-06-30: patched: Fix confirmed in version 4.0.0-beta.464