CVE-2026-34592 PUBLISHED

Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure

Assigner: GitHub_M
Reserved: 30.03.2026 Published: 29.06.2026 Updated: 30.06.2026

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access servers and projects belonging to other teams by specifying their IDs directly. This vulnerability is fixed in 4.0.0-beta.471.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Product Status

Vendor coollabsio
Product coolify
Versions
  • Version < 4.0.0-beta.471 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE