CVE-2026-32718 PUBLISHED

Coolify read-scoped API tokens can perform state-changing validation operations

Assigner: GitHub_M
Reserved: 13.03.2026 Published: 06.07.2026 Updated: 07.07.2026

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	coollabsio
Product	coolify
Versions	Version < 4.0.0-beta.466 is affected

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v
https://github.com/coollabsio/coolify/pull/8893
https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a

Problem Types

CWE-863: Incorrect Authorization CWE