Coolify CVE-2026-32718

Exploitation requires possession of a valid Coolify API token with at least read scope - the attacker must be an authenticated user of the Coolify instance. This is confirmed by the CVSS vector PR:L (low privilege). The specific vulnerable surface is limited to API endpoints designated as validation endpoints (e.g., cloud token validation, server validation) that are incorrectly guarded by read ability instead of write ability. Default configurations are vulnerable as long as read-scoped tokens exist and have been issued. Exploitation is limited to users who have been explicitly granted API access to the Coolify instance; unauthenticated external attackers cannot exploit this vulnerability. Single-user deployments where only the admin holds an API token face negligible practical risk.

The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible flaw with low-privilege authentication required (PR:L), low attack complexity, no user interaction, and high integrity impact with no confidentiality or availability impact. The PR:L requirement is the key limiting factor - exploitation is bounded to users who already possess a valid Coolify API token, even one with read-only scope. This meaningfully reduces the attack surface compared to unauthenticated vulnerabilities. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, with no public POC identified at time of analysis. Real-world risk is moderate for multi-tenant or team-deployed Coolify instances where API tokens are distributed to multiple users with varying trust levels; a low-trust user could escalate their effective capabilities to trigger server or cloud credential validation operations. For single-user self-hosted deployments, practical risk is low. There are no conflicting signals in the available data.

An attacker who has been issued a read-only API token - for example, a developer or monitoring service with intentionally restricted access - crafts API requests to the mutating validation endpoints (such as cloud credential validation or server connectivity checks) that should require write permissions. Because the authorization guard checks only for read ability, the request succeeds and the attacker can trigger state-changing operations on the Coolify-managed infrastructure. No public exploit code has been identified, but the straightforward nature of the authorization bypass makes this trivially reproducible by any API-familiar user.