# CVE-2026-34044: Coolify IDOR in Logs component allows cross-team log access

Source: https://junglewise.ai/threats/cve-2026-34044-coolify-idor-in-logs-component-allows-cross-team-log-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34044 · Severity: high · CVSS 7.7 · Published 2026-07-07

Coolify, an open-source platform for managing servers and applications, contains a security flaw that allows users to view logs belonging to other teams. By providing a specific identifier for a resource they do not own, an authenticated user can bypass privacy boundaries to access sensitive information. This could lead to the exposure of application secrets, tokens, or other private data contained within system logs.

## Quick answers

**Is CVE-2026-34044 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34044 being exploited in the wild.

**How severe is CVE-2026-34044?** High severity, with a CVSS score of 7.7, published 7 July 2026.

**Which products and versions are affected?** coollabsio Coolify < 4.0.0-beta.466.

**Is there a fix for CVE-2026-34044?** A patch was published on 2026-03-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34044 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34044?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Logs::mount() component of Coolify. The application performs resource lookups using UUIDs provided in request parameters but fails to verify that the requested resource belongs to the authenticated user's team. An attacker with a valid account can access logs for applications, services, or databases owned by other tenants by supplying the target resource's UUID. This vulnerability is classified under CWE-639 and was addressed in version 4.0.0-beta.466 by implementing team-scoped queries (ownedByCurrentTeam()) for resource resolution.

## Affected products

- coollabsio Coolify < 4.0.0-beta.466

## Timeline

- 2026-03-04: disclosed: Vulnerability reported by Xyptonize
- 2026-03-10: patched: Fix committed to repository
- 2026-03-11: patched: Version 4.0.0-beta.466 released
- 2026-07-07: advisory: GitHub Advisory and CVE published

## References

- [https://github.com/coollabsio/coolify/commit/6fbb5e626a82c576ae7a1a08b4e1d16aee2e82ed](https://github.com/coollabsio/coolify/commit/6fbb5e626a82c576ae7a1a08b4e1d16aee2e82ed)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-565g-9j4m-wqmr](https://github.com/coollabsio/coolify/security/advisories/GHSA-565g-9j4m-wqmr)