Executive brief
Coolify, an open-source tool for managing servers and applications, contains a security flaw that allows users to interact with servers belonging to other teams. By manipulating web addresses (URLs), an authorized user could deploy applications onto another customer's server or execute commands on servers they do not own. This could lead to unauthorized access to sensitive data, service disruptions, and a total compromise of the affected servers.
Technical details
Coolify prior to version 4.0.0-beta.474 is vulnerable to an Insecure Direct Object Reference (IDOR) and missing authorization checks within several Livewire web UI components. While the API controllers correctly validate server ownership, components such as 'app/Livewire/Project/Resource/Create.php' and the boarding flow accept 'server_id' and 'destination_uuid' directly from URL query parameters without verifying team ownership. An authenticated attacker can exploit this by providing the ID or UUID of a server belonging to a different team, enabling them to deploy containers to that server or execute SSH commands via the boarding flow's validation process. The vulnerability is fixed in version 4.0.0-beta.474 by ensuring all server and destination lookups are scoped to the current team.
Affected products
- coollabsio Coolify < 4.0.0-beta.474
Timeline
- 2026-06-28: advisory: GitHub Security Advisory published by vendor
- 2026-06-29: disclosed: CVE published to NVD
- 2026-06-28: patched: Vulnerability fixed in version 4.0.0-beta.474