Executive brief
Coolify is an open-source platform used to manage and automate the deployment of servers, applications, and databases. A security flaw allowed users with restricted "read-only" access tokens to perform administrative actions, such as creating new projects or validating server connections. This could allow an unauthorized user to modify infrastructure settings or disrupt operations by triggering backend tasks they should not have access to.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Coolify's API where several state-changing (mutating) endpoints were incorrectly protected by the 'read' permission scope instead of 'write'. Specifically, endpoints such as POST /v1/projects, POST /v1/servers, and GET /v1/servers/{uuid}/validate (which triggers background jobs) were accessible using read-only API tokens. An authenticated attacker with a low-privileged read-scoped token could exploit this to create resources or trigger infrastructure mutations. The issue was addressed in version 4.0.0-beta.466 by updating the middleware requirements for these routes to enforce 'api.ability:write'.
Affected products
- coollabsio Coolify < 4.0.0-beta.466
Timeline
- 2026-03-04: disclosed: Vulnerability discovered by Xyptonize
- 2026-03-11: patched: Fixed in version 4.0.0-beta.466
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-06: advisory: NVD published CVE-2026-32718