Executive brief
Coolify is an open-source platform used to manage servers, applications, and databases. A security flaw in its activity monitoring component allows any logged-in user to view the command history and output of tasks performed by other teams. This could lead to the exposure of sensitive information, such as passwords, secret keys, and infrastructure configuration details.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the ActivityMonitor Livewire component of Coolify. The component exposes a public $activityId property without the #[Locked] attribute, allowing users to modify the ID in client-side requests. Furthermore, the backend loads activity records using Activity::find($this->activityId) without performing authorization checks or team-scoping. Because activity IDs are auto-incrementing integers, an authenticated attacker can iterate through IDs to view the full command output of remote SSH processes across the entire instance. This output often contains sensitive environment variables, secrets, and infrastructure metadata. The issue was resolved in version 4.0.0-beta.471 by locking the property and implementing team ownership verification.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-26: patched: Fix committed to repository
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-06: disclosed: CVE published to NVD