Executive brief
Coolify, an open-source tool used for managing servers and application deployments, contains a security flaw that allows users to see information belonging to other teams. An authenticated user can exploit this to discover the private domain names and web addresses of applications they do not own. This could lead to the exposure of internal naming conventions and the discovery of private tools or services hosted on the platform.
Technical details
An authorization bypass (CWE-639) exists in the `domains_by_server` endpoint of the Coolify API. Specifically, the `GET /api/v1/servers/{server_uuid}/domains` endpoint fails to enforce team-based access controls when the optional `uuid` query parameter is provided. The vulnerable code in `app/Http/Controllers/Api/ServersController.php` short-circuits to a global query that does not validate if the requested application UUID belongs to the authenticated user's team. An attacker with valid API credentials can use this to enumerate Fully Qualified Domain Names (FQDNs) and application structures across the entire instance. The issue is resolved in version 4.0.0-beta.464 by ensuring the query is scoped to the current team.
Affected products
- coollabsio Coolify < 4.0.0-beta.464
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published by vendor
- 2026-06-30: disclosed: CVE published to NVD
- 2026-06-30: patched: Fix released in version 4.0.0-beta.464