Executive brief
Coolify, an open-source tool for managing servers and applications, contained a security flaw that could allow an attacker to take over a user's account. By tricking a logged-in user into clicking a specially crafted invitation link, an attacker could force a password reset to a value known only to the attacker. This could lead to unauthorized access to sensitive server configurations, application secrets, and deployment environments.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the invitation handling logic of Coolify. The 'acceptInvitation' function in 'Controller.php' processed state-changing password resets via a GET request when a 'reset-password' query parameter was present. Because GET requests lack CSRF protection, an attacker (such as a team admin) could craft a URL using a known invitation UUID and trick a victim into visiting it. This action resets the victim's password to a hash of the UUID, which is known to the attacker, leading to full account takeover. The issue was resolved in version 4.0.0-beta.471 by refactoring the invitation flow to use a POST request for state changes and implementing proper form validation.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-26: patched: Fix committed to repository
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD