What is the CVSS score of CVE-2026-32718?

CVE-2026-32718 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-32718?

Yes, a patch is available for CVE-2026-32718. Update the affected software to the latest version immediately.

Coolify CVE-2026-32718

EUVD-2026-41949 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-06 GitHub_M

Authentication Bypass Coolify Coollabsio

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable API requiring a low-privilege read token (PR:L); no confidentiality or availability impact, only integrity via unauthorized state-changing calls.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:51 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466.

AnalysisAI

Incorrect authorization in Coolify's API layer allows any holder of a read-scoped API token to invoke mutating validation endpoints - including cloud token validation and server validation - that should require write-level privileges. All Coolify deployments prior to version 4.0.0-beta.466 are affected. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via API make this straightforward to abuse for any user who has been issued even a minimal API token.

Technical ContextAI

Coolify (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) is a self-hostable platform for managing servers, applications, and databases via an API-driven interface. The root cause is CWE-863 (Incorrect Authorization): the application applies an authorization check to mutating API endpoints but evaluates the wrong permission scope - checking for 'read' ability rather than 'write' or 'admin' ability before allowing state-changing operations such as validating cloud provider credentials and server connectivity. This is a logic error in the middleware or policy layer, not a missing check entirely, meaning standard authentication is enforced but the permission granularity is wrong. The GitHub security advisory GHSA-f47p-xrgc-977v and the associated fix commit c15bcd56347fc8c535755791e92e4f6c2af17e3a confirm the root cause and resolution.

RemediationAI

Upgrade to Coolify version 4.0.0-beta.466 or later, which resolves the incorrect authorization check on mutating validation endpoints. The upstream fix is available in commit c15bcd56347fc8c535755791e92e4f6c2af17e3a and pull request https://github.com/coollabsio/coolify/pull/8893. If immediate upgrade is not possible, a compensating control is to audit and revoke any read-scoped API tokens issued to untrusted or low-privilege users, restricting API token issuance to only fully trusted accounts until the patch is applied. This trade-off reduces operational flexibility but eliminates the privilege boundary confusion. Operators should also review API token audit logs for any unexpected calls to cloud token or server validation endpoints by read-scoped tokens, as these would indicate potential abuse prior to patching.