Coolify CVE-2026-15507

Q: What is the CVSS score of CVE-2026-15507?

CVE-2026-15507 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43248 LOW

Missing Authorization (CWE-862)

2026-07-12 cna@vuldb.com

GHSA-6qvw-24xv-xqw6

Authentication Bypass

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable but requires authenticated low-privileged account (PR:L); no scope change; impact is limited to low across CIA triad per CVSS 4.0 mapping.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 22:30 vuln.today

DescriptionCVE.org

A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy Handler. Performing a manipulation results in missing authorization. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

Missing authorization in Coolify's Policy Handler allows authenticated remote attackers to bypass resource-level access controls in versions up to 4.1.1. The flaw resides in the /app/Policies/ component, where policy enforcement checks are absent or incomplete, enabling low-privileged users to access or manipulate resources beyond their intended authorization scope. A public proof-of-concept exploit is available, raising the urgency for operators running self-hosted Coolify instances.

Technical ContextAI

Coolify is an open-source, self-hostable platform for managing server deployments, databases, and applications - comparable to Heroku or Netlify. It is built on Laravel (PHP), which uses a Policy class pattern under /app/Policies/ to enforce per-resource authorization logic. CWE-862 (Missing Authorization) indicates that the application performs sensitive operations without verifying that the requesting user is authorized - distinct from authentication failure. The specific policy stub or stubs involved are described as unknown functions within that directory, but the published POC archive (coolify-resource-policy-stubs.zip) suggests incomplete or stubbed-out policy method implementations that return permissive defaults rather than enforcing ownership or role checks.

RemediationAI

Upgrade Coolify to a version beyond 4.1.1 once a patched release is issued by coollabsio - no confirmed patched version number is present in the available data, so monitor the official Coolify GitHub repository and release notes for a fix. As a compensating control, restrict Coolify instance access to trusted users only and avoid multi-tenant deployments where untrusted low-privileged accounts exist until a patch is confirmed. Review /app/Policies/ method implementations for stubs returning true or null by default and manually enforce deny-by-default logic. Enabling network-level access controls (firewall rules, VPN-only access) reduces exposure but does not mitigate the authorization flaw for already-authenticated users. Consult VulDB entry https://vuldb.com/vuln/377836 and the researcher's POC at https://github.com/lakshayyverma/CVE-Discovery/blob/main/coolify-resource-policy-stubs.zip for technical detail.