# CVE-2026-34171: Coolify account takeover via CSRF in invitation endpoint

Source: https://junglewise.ai/threats/cve-2026-34171-coolify-account-takeover-via-csrf-in-invitation-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34171 · Severity: high · CVSS 8 · Published 2026-07-07

Coolify, an open-source tool for managing servers and applications, contained a security flaw that could allow an attacker to take over a user's account. By tricking a logged-in user into clicking a specially crafted invitation link, an attacker could force a password reset to a value known only to the attacker. This could lead to unauthorized access to sensitive server configurations, application secrets, and deployment environments.

Technologies: [Coollabs Coolify](https://junglewise.ai/threats/technologies/coolify). Vendors: [Coollabs](https://junglewise.ai/threats/vendors/coollabs).

## Quick answers

**Is CVE-2026-34171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34171 being exploited in the wild.

**How severe is CVE-2026-34171?** High severity, with a CVSS score of 8, published 7 July 2026.

**Which products and versions are affected?** Coollabs Coolify < 4.0.0-beta.471.

**Is there a fix for CVE-2026-34171?** A patch was published on 2026-03-26: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34171 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34171?** Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the invitation handling logic of Coolify. The 'acceptInvitation' function in 'Controller.php' processed state-changing password resets via a GET request when a 'reset-password' query parameter was present. Because GET requests lack CSRF protection, an attacker (such as a team admin) could craft a URL using a known invitation UUID and trick a victim into visiting it. This action resets the victim's password to a hash of the UUID, which is known to the attacker, leading to full account takeover. The issue was resolved in version 4.0.0-beta.471 by refactoring the invitation flow to use a POST request for state changes and implementing proper form validation.

## Affected products

- coollabsio Coolify < 4.0.0-beta.471

## Timeline

- 2026-03-26: patched: Fix committed to repository
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD

## References

- [https://github.com/coollabsio/coolify/commit/25d424c743d5134d4a005a6d8f754bb3235b632c](https://github.com/coollabsio/coolify/commit/25d424c743d5134d4a005a6d8f754bb3235b632c)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-389w-cc6x-wr2m](https://github.com/coollabsio/coolify/security/advisories/GHSA-389w-cc6x-wr2m)

## Related threats

- [Coolify information disclosure via webhook enumeration](https://junglewise.ai/threats/cve-2026-121587-coolify-before-4-1-1-contains-an-information-disclosure)
- [Coollabsio Coolify path traversal in PostgreSQL init scripts](https://junglewise.ai/threats/cve-2026-42200-coollabsio-coolify-path-traversal-in-postgresql-init-scripts)
- [Coollabs Coolify insufficient session expiration for API tokens](https://junglewise.ai/threats/cve-2026-42172-coollabs-coolify-insufficient-session-expiration-for-api-tokens)
- [Coollabsio Coolify SSRF in S3 storage endpoint validation](https://junglewise.ai/threats/cve-2026-42147-coollabsio-coolify-ssrf-in-s3-storage-endpoint-validation)
- [Coollabs Coolify OS command injection in LocalPersistentVolume name](https://junglewise.ai/threats/cve-2026-34168-coollabs-coolify-os-command-injection-in-localpersistentvolume)